Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/12/2024, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe
-
Size
10.4MB
-
MD5
f7337c874dc52cb9c05855846b4cc0c2
-
SHA1
557ea34cad7f5de0f875220ea32f1891392362ae
-
SHA256
8f4455c865efb65d8ff1395429873ebadb7f52e44da1398fa8ea6ee3e9cc0457
-
SHA512
783aae33663a4db32f88ea6321a696103ba060b0776436f0aebfeff00a2672fb049dab66594a3809f7fc794d15d7e451bffb0c77f2eb2c39038ce4f808fb07fd
-
SSDEEP
24576:DoGUbmtvDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD/:P9t
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Tofsee family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\rnnzklak = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2728 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rnnzklak\ImagePath = "C:\\Windows\\SysWOW64\\rnnzklak\\gvieqpiu.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2808 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2848 gvieqpiu.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2848 set thread context of 2808 2848 gvieqpiu.exe 44 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2760 sc.exe 2720 sc.exe 2836 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gvieqpiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2348 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 31 PID 2544 wrote to memory of 2348 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 31 PID 2544 wrote to memory of 2348 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 31 PID 2544 wrote to memory of 2348 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 31 PID 2544 wrote to memory of 2496 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2496 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2496 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2496 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 33 PID 2544 wrote to memory of 2760 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 35 PID 2544 wrote to memory of 2760 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 35 PID 2544 wrote to memory of 2760 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 35 PID 2544 wrote to memory of 2760 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 35 PID 2544 wrote to memory of 2720 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 37 PID 2544 wrote to memory of 2720 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 37 PID 2544 wrote to memory of 2720 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 37 PID 2544 wrote to memory of 2720 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 37 PID 2544 wrote to memory of 2836 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 39 PID 2544 wrote to memory of 2836 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 39 PID 2544 wrote to memory of 2836 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 39 PID 2544 wrote to memory of 2836 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 39 PID 2544 wrote to memory of 2728 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 42 PID 2544 wrote to memory of 2728 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 42 PID 2544 wrote to memory of 2728 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 42 PID 2544 wrote to memory of 2728 2544 f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe 42 PID 2848 wrote to memory of 2808 2848 gvieqpiu.exe 44 PID 2848 wrote to memory of 2808 2848 gvieqpiu.exe 44 PID 2848 wrote to memory of 2808 2848 gvieqpiu.exe 44 PID 2848 wrote to memory of 2808 2848 gvieqpiu.exe 44 PID 2848 wrote to memory of 2808 2848 gvieqpiu.exe 44 PID 2848 wrote to memory of 2808 2848 gvieqpiu.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rnnzklak\2⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gvieqpiu.exe" C:\Windows\SysWOW64\rnnzklak\2⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create rnnzklak binPath= "C:\Windows\SysWOW64\rnnzklak\gvieqpiu.exe /d\"C:\Users\Admin\AppData\Local\Temp\f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description rnnzklak "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start rnnzklak2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2728
-
-
C:\Windows\SysWOW64\rnnzklak\gvieqpiu.exeC:\Windows\SysWOW64\rnnzklak\gvieqpiu.exe /d"C:\Users\Admin\AppData\Local\Temp\f7337c874dc52cb9c05855846b4cc0c2_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.0MB
MD5e2ad15bd158d5bfe98d7ebcdbc8da710
SHA16c2d1d15e0a94bde8af93c84411fabbf9583e2d6
SHA256b94b7910a58ca855836ae7574575f9514bc859a313d2b5e0580550757c1c07a3
SHA5126ce2c6f415bd649260b96d79492f6f9810d0ae0a0e449dc6ee61697db8911bf51b70c42f33399f98a868c815389726173f751a8d7f52c973efdea5eee917b415