Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe
-
Size
755KB
-
MD5
a1afa361dab7f2a129e0d6a7d79d6fbd
-
SHA1
967fb6c387fb8b7fb6aaca5d2bc91282f8fe11f2
-
SHA256
e930fe9f06b1692b7486305fcc661b213cc290f6b00c681e75386293107a7feb
-
SHA512
c0b06b5735294c00c9950be1406f5b6cd845a569af0f5d8c3b2c0d63ba122135d715dd2a5eb7f48f25a3925808af61b11fa23a80c07d1cbf355100d2764dad80
-
SSDEEP
12288:+Ma65M1l92EiqfUC/wnTI7NPMKkp3JBRvqwTlXndGvnOx7mx4UJvSxjtVAkK/omp:+JZZsC/vxMKkp3JBRvqwTlXndGnDExV+
Malware Config
Extracted
xtremerat
silent-hilll.no-ip.biz
Signatures
-
Detect XtremeRAT payload 10 IoCs
resource yara_rule behavioral1/memory/2776-3-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-4-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-18-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-14-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-12-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-10-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-7-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2784-21-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2776-24-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat behavioral1/memory/2784-26-0x0000000010000000-0x000000001004A000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A4YA4O85-G366-U810-3V7N-1238CMDAFDF4} cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A4YA4O85-G366-U810-3V7N-1238CMDAFDF4}\StubPath = "C:\\Windows\\system32\\InstallDir\\xp.exe restart" cmd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A4YA4O85-G366-U810-3V7N-1238CMDAFDF4} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A4YA4O85-G366-U810-3V7N-1238CMDAFDF4}\StubPath = "C:\\Windows\\system32\\InstallDir\\xp.exe" svchost.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\xp.exe" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\xp.exe" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Windows\\system32\\InstallDir\\xp.exe" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\xp.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\xp.exe" svchost.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\xp.exe cmd.exe File created C:\Windows\SysWOW64\InstallDir\xp.exe cmd.exe File opened for modification C:\Windows\SysWOW64\InstallDir\ cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2500 set thread context of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2776 cmd.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2500 wrote to memory of 2776 2500 a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe 30 PID 2776 wrote to memory of 2784 2776 cmd.exe 31 PID 2776 wrote to memory of 2784 2776 cmd.exe 31 PID 2776 wrote to memory of 2784 2776 cmd.exe 31 PID 2776 wrote to memory of 2784 2776 cmd.exe 31 PID 2776 wrote to memory of 2784 2776 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1afa361dab7f2a129e0d6a7d79d6fbd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\windows\SysWOW64\cmd.exec:\windows\system32\cmd.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\windows\SysWOW64\svchost.exesvchost.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2784
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1