Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 22:06 UTC

General

  • Target

    f5f047d423671c1285618446c0450542_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    f5f047d423671c1285618446c0450542

  • SHA1

    356f6878bd3579240f88edc87b89552c86a9f81f

  • SHA256

    19fc15f5fb03d827d352cec67baacf19954b69219d40f8ad5bc4de18064c60b8

  • SHA512

    3b3fbde9b5612368416ffeb139e326665854f324565f4147b6145182abf20125d6097609fc9c68aaa4870f298820e2aa1ed62214b19e519c7022d8c2fc37e0a1

  • SSDEEP

    1536:/5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAERg+ldHDbLLtvQnXpS0UiCHvrl:/p5wfCQF92HpkeWpS+lNDbLxQG7p

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Modifies firewall policy service 3 TTPs 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\SysWOW64\net.exe
        net stop SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2740
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Security Center"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\SysWOW64\net.exe
        net stop "Security Center"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Security Center"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2096
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net start SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\SysWOW64\net.exe
        net start SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    640B

    MD5

    70237e6c7f12f17048117b2e1098aef9

    SHA1

    b9735214963e8e3b791bf7113bebbbbf65c4d36d

    SHA256

    6d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c

    SHA512

    bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee

  • C:\a.bat

    Filesize

    1KB

    MD5

    d807ec0161c542b23e37898db356c95b

    SHA1

    0aac2ef8e1d77868d932a10007efcbd0b69ecdfc

    SHA256

    56cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37

    SHA512

    538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf

  • memory/2392-0-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

  • memory/2392-1-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2392-34-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.