Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2024, 22:13

General

  • Target

    9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe

  • Size

    351KB

  • MD5

    9e30414d0fc9fbe797e41cab5100a714

  • SHA1

    b7f8accc729abc276a0510657becab414506d789

  • SHA256

    481821d0313006387cdb23cce4829f157c3f299e6ccbe284aeecf322826d2c7e

  • SHA512

    cfea07aae4ade705e57479ff8fb242b2a7407baa68260e4a0dd7ce77975e58026348cc9a41dfd2324a6ea45bff1a7e831c42ac065e1c7462ca777e5cabaf4fa6

  • SSDEEP

    6144:O0y3NRJO22A8oos+W0OBMgxDy1+yAD2qGr5Pe3q9Yng:OBNfORjVOB7xDQ1AD2qGrJe3q9Yn

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Gozi family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9e30414d0fc9fbe797e41cab5100a714_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CFFC\E7FE.bat" "C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\9E3041~1.EXE""
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\9E3041~1.EXE""
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
            "C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\9E3041~1.EXE"
            5⤵
            • Deletes itself
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2712
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CFFC\E7FE.bat

    Filesize

    112B

    MD5

    401973cd1c47c208b547467b34e36d3c

    SHA1

    693072a9b98e4e93430840de522865d61d346fe9

    SHA256

    a48f554e136e28233c1387c42d551724f97e973b8bd26327cc4ae76e129aa559

    SHA512

    cdebce3bf8e04731ccf71c3164e346530c394c7a1590299a1ce011d0d1ca8ac3ca0c8490b1b0d41a7694c8f85c251ad33ed0e1c089893dd233a02820069ee64e

  • C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe

    Filesize

    351KB

    MD5

    9e30414d0fc9fbe797e41cab5100a714

    SHA1

    b7f8accc729abc276a0510657becab414506d789

    SHA256

    481821d0313006387cdb23cce4829f157c3f299e6ccbe284aeecf322826d2c7e

    SHA512

    cfea07aae4ade705e57479ff8fb242b2a7407baa68260e4a0dd7ce77975e58026348cc9a41dfd2324a6ea45bff1a7e831c42ac065e1c7462ca777e5cabaf4fa6

  • memory/1208-41-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-30-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-43-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-48-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-42-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-46-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-39-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/1208-34-0x0000000002E00000-0x0000000002E01000-memory.dmp

    Filesize

    4KB

  • memory/1208-35-0x0000000002D80000-0x0000000002DF5000-memory.dmp

    Filesize

    468KB

  • memory/2328-12-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2328-0-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2328-2-0x00000000001C0000-0x00000000001F0000-memory.dmp

    Filesize

    192KB

  • memory/2712-19-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2712-26-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/2712-27-0x0000000000230000-0x0000000000260000-memory.dmp

    Filesize

    192KB

  • memory/2712-18-0x0000000000230000-0x0000000000260000-memory.dmp

    Filesize

    192KB

  • memory/2788-45-0x00000000000D0000-0x0000000000145000-memory.dmp

    Filesize

    468KB

  • memory/2788-36-0x00000000000D0000-0x0000000000145000-memory.dmp

    Filesize

    468KB

  • memory/2788-28-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2788-29-0x00000000000D0000-0x0000000000145000-memory.dmp

    Filesize

    468KB

  • memory/2788-23-0x00000000000D0000-0x0000000000145000-memory.dmp

    Filesize

    468KB

  • memory/2788-21-0x000007FFFFFDC000-0x000007FFFFFDD000-memory.dmp

    Filesize

    4KB