Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe
-
Size
12.9MB
-
MD5
e5411982e48ac4e1458b3671a97177fe
-
SHA1
1d8b356af353be5708d53527b5c9a09d4f442e94
-
SHA256
ac3310b8260fc47ddf03699e3efcb700099b2daa4b751f5c0fcaa1abb69643a3
-
SHA512
fe220b6c34fce251f80ae93d00a6d72f2afa9bd7e078dc76df5eee22102e2dc01cb41cf68fd0b9dabafeb58ea24521e3c80d76082e7a73b5c9d680426d058be2
-
SSDEEP
24576:ME2llllllllllllllllllllllllllllllllllllllllllllllllllllllllllll/:ME
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Tofsee family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\swzsydaq = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2884 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\swzsydaq\ImagePath = "C:\\Windows\\SysWOW64\\swzsydaq\\fuhdpoht.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2832 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2840 fuhdpoht.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2840 set thread context of 2832 2840 fuhdpoht.exe 44 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 988 sc.exe 2156 sc.exe 2276 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fuhdpoht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2428 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2428 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2428 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2428 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2332 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 32 PID 2908 wrote to memory of 2332 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 32 PID 2908 wrote to memory of 2332 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 32 PID 2908 wrote to memory of 2332 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 32 PID 2908 wrote to memory of 988 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 34 PID 2908 wrote to memory of 988 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 34 PID 2908 wrote to memory of 988 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 34 PID 2908 wrote to memory of 988 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 34 PID 2908 wrote to memory of 2156 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2156 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2156 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2156 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 36 PID 2908 wrote to memory of 2276 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 38 PID 2908 wrote to memory of 2276 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 38 PID 2908 wrote to memory of 2276 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 38 PID 2908 wrote to memory of 2276 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 38 PID 2908 wrote to memory of 2884 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 41 PID 2908 wrote to memory of 2884 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 41 PID 2908 wrote to memory of 2884 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 41 PID 2908 wrote to memory of 2884 2908 e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe 41 PID 2840 wrote to memory of 2832 2840 fuhdpoht.exe 44 PID 2840 wrote to memory of 2832 2840 fuhdpoht.exe 44 PID 2840 wrote to memory of 2832 2840 fuhdpoht.exe 44 PID 2840 wrote to memory of 2832 2840 fuhdpoht.exe 44 PID 2840 wrote to memory of 2832 2840 fuhdpoht.exe 44 PID 2840 wrote to memory of 2832 2840 fuhdpoht.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\swzsydaq\2⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fuhdpoht.exe" C:\Windows\SysWOW64\swzsydaq\2⤵
- System Location Discovery: System Language Discovery
PID:2332
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create swzsydaq binPath= "C:\Windows\SysWOW64\swzsydaq\fuhdpoht.exe /d\"C:\Users\Admin\AppData\Local\Temp\e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:988
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description swzsydaq "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2156
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start swzsydaq2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2276
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2884
-
-
C:\Windows\SysWOW64\swzsydaq\fuhdpoht.exeC:\Windows\SysWOW64\swzsydaq\fuhdpoht.exe /d"C:\Users\Admin\AppData\Local\Temp\e5411982e48ac4e1458b3671a97177fe_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.0MB
MD53d493c267faebead2ada65f42c1d0f39
SHA1d138609826640357a496ae915f96b0d910d496f8
SHA256737063d86efbb8a7459c29898cd16f4f86537ab8caad9b7b26a27f49e18c9136
SHA5120c86cc8f0b240bdae974e02dd0b9aa1e3b3ce8f23dc637d76fb9c447933103d7862b5a1cef7a4d6d28374166953abf8fafc02120d70c732caec4268928aef5cb