Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe
-
Size
351KB
-
MD5
9e30414d0fc9fbe797e41cab5100a714
-
SHA1
b7f8accc729abc276a0510657becab414506d789
-
SHA256
481821d0313006387cdb23cce4829f157c3f299e6ccbe284aeecf322826d2c7e
-
SHA512
cfea07aae4ade705e57479ff8fb242b2a7407baa68260e4a0dd7ce77975e58026348cc9a41dfd2324a6ea45bff1a7e831c42ac065e1c7462ca777e5cabaf4fa6
-
SSDEEP
6144:O0y3NRJO22A8oos+W0OBMgxDy1+yAD2qGr5Pe3q9Yng:OBNfORjVOB7xDQ1AD2qGrJe3q9Yn
Malware Config
Extracted
gozi
Extracted
gozi
1010
diuolirt.at
deopliazae.at
nifredao.com
filokiyurt.at
-
exe_type
worker
-
server_id
12
Signatures
-
Gozi family
-
Deletes itself 1 IoCs
pid Process 2712 chtbider.exe -
Executes dropped EXE 1 IoCs
pid Process 2712 chtbider.exe -
Loads dropped DLL 2 IoCs
pid Process 2244 cmd.exe 2244 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\DHCPupnp = "C:\\Users\\Admin\\AppData\\Roaming\\drprssec\\chtbider.exe" 9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2712 set thread context of 2788 2712 chtbider.exe 35 PID 2788 set thread context of 1208 2788 svchost.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chtbider.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 chtbider.exe 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2712 chtbider.exe 2788 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2324 2328 9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe 31 PID 2328 wrote to memory of 2324 2328 9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe 31 PID 2328 wrote to memory of 2324 2328 9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe 31 PID 2328 wrote to memory of 2324 2328 9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe 31 PID 2324 wrote to memory of 2244 2324 cmd.exe 33 PID 2324 wrote to memory of 2244 2324 cmd.exe 33 PID 2324 wrote to memory of 2244 2324 cmd.exe 33 PID 2324 wrote to memory of 2244 2324 cmd.exe 33 PID 2244 wrote to memory of 2712 2244 cmd.exe 34 PID 2244 wrote to memory of 2712 2244 cmd.exe 34 PID 2244 wrote to memory of 2712 2244 cmd.exe 34 PID 2244 wrote to memory of 2712 2244 cmd.exe 34 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2712 wrote to memory of 2788 2712 chtbider.exe 35 PID 2788 wrote to memory of 1208 2788 svchost.exe 21 PID 2788 wrote to memory of 1208 2788 svchost.exe 21 PID 2788 wrote to memory of 1208 2788 svchost.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CFFC\E7FE.bat" "C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\9E3041~1.EXE""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\9E3041~1.EXE""4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe"C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\9E3041~1.EXE"5⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2788
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112B
MD5401973cd1c47c208b547467b34e36d3c
SHA1693072a9b98e4e93430840de522865d61d346fe9
SHA256a48f554e136e28233c1387c42d551724f97e973b8bd26327cc4ae76e129aa559
SHA512cdebce3bf8e04731ccf71c3164e346530c394c7a1590299a1ce011d0d1ca8ac3ca0c8490b1b0d41a7694c8f85c251ad33ed0e1c089893dd233a02820069ee64e
-
Filesize
351KB
MD59e30414d0fc9fbe797e41cab5100a714
SHA1b7f8accc729abc276a0510657becab414506d789
SHA256481821d0313006387cdb23cce4829f157c3f299e6ccbe284aeecf322826d2c7e
SHA512cfea07aae4ade705e57479ff8fb242b2a7407baa68260e4a0dd7ce77975e58026348cc9a41dfd2324a6ea45bff1a7e831c42ac065e1c7462ca777e5cabaf4fa6