Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/12/2024, 22:06

General

  • Target

    f5f047d423671c1285618446c0450542_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    f5f047d423671c1285618446c0450542

  • SHA1

    356f6878bd3579240f88edc87b89552c86a9f81f

  • SHA256

    19fc15f5fb03d827d352cec67baacf19954b69219d40f8ad5bc4de18064c60b8

  • SHA512

    3b3fbde9b5612368416ffeb139e326665854f324565f4147b6145182abf20125d6097609fc9c68aaa4870f298820e2aa1ed62214b19e519c7022d8c2fc37e0a1

  • SSDEEP

    1536:/5sc375Ab4EBanICQFuIiyd6gWHpkeaPRAERg+ldHDbLLtvQnXpS0UiCHvrl:/p5wfCQF92HpkeWpS+lNDbLxQG7p

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Modifies firewall policy service 3 TTPs 2 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f5f047d423671c1285618446c0450542_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\net.exe
        net stop SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3196
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2512
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\a.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:3936
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Security Center"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Windows\SysWOW64\net.exe
        net stop "Security Center"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:396
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Security Center"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2072
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net start SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\net.exe
        net start SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1.reg

    Filesize

    640B

    MD5

    70237e6c7f12f17048117b2e1098aef9

    SHA1

    b9735214963e8e3b791bf7113bebbbbf65c4d36d

    SHA256

    6d93c70335964c039571168a9f805954a524287b1c628450a269ba14c10a096c

    SHA512

    bdfef5f2890afda7e9d786514d47cf2a25957c82d795ed7e71d614244fb67835fef03758e76ca1056751d7182ebad3442b412587ecc3d7dc1737d4743077bcee

  • \??\c:\a.bat

    Filesize

    1KB

    MD5

    d807ec0161c542b23e37898db356c95b

    SHA1

    0aac2ef8e1d77868d932a10007efcbd0b69ecdfc

    SHA256

    56cdc18d3a8b4f2059f1e17e7017b10dcfe2eef840190843dc04fa737f5b6a37

    SHA512

    538082e228d8e61e09d368f674b581550791153b107abe189623666b81731b7f3470a079043d7ac96339217361d73b5fe62ae2b5b103499ddf750fb89d492cdf

  • memory/4832-0-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

  • memory/4832-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

    Filesize

    8KB

  • memory/4832-29-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB