Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 22:06

General

  • Target

    f5f047d423671c1285618446c0450542_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    f5f047d423671c1285618446c0450542

  • SHA1

    356f6878bd3579240f88edc87b89552c86a9f81f

  • SHA256

    19fc15f5fb03d827d352cec67baacf19954b69219d40f8ad5bc4de18064c60b8

  • SHA512

    3b3fbde9b5612368416ffeb139e326665854f324565f4147b6145182abf20125d6097609fc9c68aaa4870f298820e2aa1ed62214b19e519c7022d8c2fc37e0a1

  • SSDEEP

    1536:/5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAERg+ldHDbLLtvQnXpS0UiCHvrl:/p5wfCQF92HpkeWpS+lNDbLxQG7p

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Modifies firewall policy service 3 TTPs 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\SysWOW64\net.exe
        net stop SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2740
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Security Center"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\SysWOW64\net.exe
        net stop "Security Center"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Security Center"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2096
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net start SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\net.exe
        net start SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    640B

    MD5

    70237e6c7f12f17048117b2e1098aef9

    SHA1

    b9735214963e8e3b791bf7113bebbbbf65c4d36d

    SHA256

    6d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c

    SHA512

    bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee

  • C:\a.bat

    Filesize

    1KB

    MD5

    d807ec0161c542b23e37898db356c95b

    SHA1

    0aac2ef8e1d77868d932a10007efcbd0b69ecdfc

    SHA256

    56cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37

    SHA512

    538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf

  • memory/2392-0-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

  • memory/2392-1-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2392-34-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB