Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2024, 16:10

General

  • Target

    b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe

  • Size

    580KB

  • MD5

    b25f6c3a4462cb9064ccb93cbe86bf65

  • SHA1

    b1e4b3e01a6ceb4c64c86b9efeb886956338a285

  • SHA256

    8b0434d0a5f7e099621e2fc4fb26120cca8851853dd6c4dc06b054d14ccc91bc

  • SHA512

    5eb594d73ba7aac21499072e0072dfb25f0107eff92b484392dfdc8d3b3edafcbab72ade2d56156940097b1e86c923248e7262654abb86459289ab0098d4a28f

  • SSDEEP

    12288:N0S3WwroioAwIGCnlDVBCRoAwIGCnlDVBCgoAwIGCnlDVBCcoAwIGCnlDVBC/j9b:Owrowj9NrQgE76OzStl

Malware Config

Extracted

Family

trickbot

Version

1000303

Botnet

lib356

C2

85.143.220.111:443

24.247.181.155:449

174.105.235.178:449

92.223.105.204:443

181.113.17.230:449

174.105.233.82:449

71.14.129.8:449

216.183.62.43:449

42.115.91.177:443

185.251.39.94:443

71.94.101.25:443

206.130.141.255:449

185.251.39.47:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

24.119.69.70:449

46.173.218.246:443

103.110.91.118:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2836
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2848
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2872
    • C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe
      C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2700
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {42044207-B344-4461-8BD0-A7ED03C6C79B} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:792
        • C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe
          C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2884
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            3⤵
            • Modifies data under HKEY_USERS
            PID:2272

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe

        Filesize

        580KB

        MD5

        b25f6c3a4462cb9064ccb93cbe86bf65

        SHA1

        b1e4b3e01a6ceb4c64c86b9efeb886956338a285

        SHA256

        8b0434d0a5f7e099621e2fc4fb26120cca8851853dd6c4dc06b054d14ccc91bc

        SHA512

        5eb594d73ba7aac21499072e0072dfb25f0107eff92b484392dfdc8d3b3edafcbab72ade2d56156940097b1e86c923248e7262654abb86459289ab0098d4a28f

      • memory/1628-50-0x0000000010000000-0x0000000010007000-memory.dmp

        Filesize

        28KB

      • memory/1628-34-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-35-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-36-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-37-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-38-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-39-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-40-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-41-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-42-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-43-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-44-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-45-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-46-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/1628-47-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-8-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-20-0x000000000044B000-0x000000000044C000-memory.dmp

        Filesize

        4KB

      • memory/2076-4-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-5-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-6-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-7-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-21-0x0000000000400000-0x0000000000493000-memory.dmp

        Filesize

        588KB

      • memory/2076-9-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-10-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-11-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-12-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-13-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-14-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-15-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-16-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-17-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2076-18-0x0000000002670000-0x00000000026B0000-memory.dmp

        Filesize

        256KB

      • memory/2076-3-0x00000000007E0000-0x00000000007E1000-memory.dmp

        Filesize

        4KB

      • memory/2700-54-0x0000000140000000-0x0000000140039000-memory.dmp

        Filesize

        228KB

      • memory/2700-57-0x0000000140000000-0x0000000140039000-memory.dmp

        Filesize

        228KB

      • memory/2884-76-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-75-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-80-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-79-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-78-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-77-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-82-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-81-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-74-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-73-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-72-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-71-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-70-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB

      • memory/2884-69-0x0000000000520000-0x0000000000521000-memory.dmp

        Filesize

        4KB