Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe
-
Size
534KB
-
MD5
3c8aa9482e04955247407008a9a58de4
-
SHA1
2a8c593fffc721c68511d2667fe5f02e4da78f1e
-
SHA256
d9a5c16a13ec68f0548a6db05db2439d6296b4704c6ee480aa0d659f77d04f4d
-
SHA512
afd17edd4fe4d93a31acbb8e9ae67311e33e30408c77ce4f5316414376d1500078e092538a03d5f13fea725e17daa4642cb30a78f4a80045bafd769daf8cc735
-
SSDEEP
12288:aH/9cLouxk5R7hNeqVIVZ7uDQMhAVb7YrK0L6YA:af9Uo4k5NhNfcZKDkbk
Malware Config
Extracted
netwire
mikebaur.ddns.net:3361
-
activex_autorun
true
-
activex_key
{6388V52T-OO22-RNFN-00O6-B48721FMJK8H}
-
copy_executable
false
-
delete_original
true
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/memory/3012-34-0x0000000000400000-0x0000000000420000-memory.dmp netwire behavioral1/memory/3012-36-0x0000000000400000-0x0000000000420000-memory.dmp netwire -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6388V52T-OO22-RNFN-00O6-B48721FMJK8H} Hosstt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6388V52T-OO22-RNFN-00O6-B48721FMJK8H}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Hosstt.exe\"" Hosstt.exe -
Executes dropped EXE 2 IoCs
pid Process 2604 Hosstt.exe 3012 Hosstt.exe -
Loads dropped DLL 1 IoCs
pid Process 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QzpcVXNlcnNcQWRtaW5cRGVza3RvcC5leGU= = "C:\\Users\\Admin\\Desktop.exe" 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Hosstt.exe" Hosstt.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2696 set thread context of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2604 set thread context of 3012 2604 Hosstt.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hosstt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hosstt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe Token: SeDebugPrivilege 2604 Hosstt.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2604 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2604 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2604 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2604 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2568 2696 3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe 31 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32 PID 2604 wrote to memory of 3012 2604 Hosstt.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Roaming\Hosstt.exe"C:\Users\Admin\AppData\Roaming\Hosstt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Roaming\Hosstt.exe"C:\Users\Admin\AppData\Roaming\Hosstt.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3012
-
-
-
C:\Users\Admin\AppData\Local\Temp\3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c8aa9482e04955247407008a9a58de4_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD500eafb463d92c03a7c860e54416cfb0a
SHA12306c1bbbb7edccb8848eb0d0f62d75260b68c07
SHA256617c5013080357ddd7761f9ee0d6a9914b001b81624a2d0c73939bad873c6b65
SHA5125b8b4dab9e40f25ec637df0b9bfa2156887b95abbf956b2271858758e33f705674d220f986f28f3851f96dca6bc8a4cdd9567adc8bdb3b216c74aeb62d68664c
-
Filesize
202KB
MD593b56794066bef1420190d63c2093cfd
SHA110385882fca74eeb4f6a285b676c9b8f68f13e20
SHA25664b841c74d8c3fa0e3218b94e85c56c95a51720447d71dcbf888015589c7dd1a
SHA51275f18a361dc9205f05f9215b392f3645b9d895bdb67cb75924d6e2632c91e9cc60a3b99c7accd487b28255e341294680dd7ed5402a677b1182f44b7fdf189918