Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    312eaf2c16f156015213781fcd38f218_JaffaCakes118

  • Size

    1.0MB

  • Sample

    241010-wfpg2sycng

  • MD5

    312eaf2c16f156015213781fcd38f218

  • SHA1

    377eeba09e7cb7ca92ca1a46b1efca425ffea73a

  • SHA256

    46b6c90d331eabb7e554cfe3baa01ed3e72b40793f7bc670f95b22ee611725a9

  • SHA512

    b499e9511f32d6a5122bd5730422df7360a91295492b8a0cd1ca0d24ffdd53a5d03a891c79469a0773b94c605f4d2f289d8719dbda4b6ac775a40216c85ca0f8

  • SSDEEP

    12288:isgYkRJNl2iNB/gj9RMKkvnnu8z0oqD9LEy9z+NeAdR6+RyVlfkYwl6mDdSQ:ijNl17CvdCnusiNf+NTdtGMbl6mB

Malware Config

Extracted

Family

netwire

C2

night90.ddns.net:8999

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    New-stub

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    true

  • mutex

    soHOGwSb

  • offline_keylogger

    true

  • password

    teamoluwa1

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      312eaf2c16f156015213781fcd38f218_JaffaCakes118

    • Size

      1.0MB

    • MD5

      312eaf2c16f156015213781fcd38f218

    • SHA1

      377eeba09e7cb7ca92ca1a46b1efca425ffea73a

    • SHA256

      46b6c90d331eabb7e554cfe3baa01ed3e72b40793f7bc670f95b22ee611725a9

    • SHA512

      b499e9511f32d6a5122bd5730422df7360a91295492b8a0cd1ca0d24ffdd53a5d03a891c79469a0773b94c605f4d2f289d8719dbda4b6ac775a40216c85ca0f8

    • SSDEEP

      12288:isgYkRJNl2iNB/gj9RMKkvnnu8z0oqD9LEy9z+NeAdR6+RyVlfkYwl6mDdSQ:ijNl17CvdCnusiNf+NTdtGMbl6mB

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Looks for VirtualBox Guest Additions in registry

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks