Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 03:05

General

  • Target

    f9d8346daea8edd2e86a54af5293d37a_JaffaCakes118.exe

  • Size

    288KB

  • MD5

    f9d8346daea8edd2e86a54af5293d37a

  • SHA1

    15840fa7c9a822838a616670bf6464444d5a8c2e

  • SHA256

    cb33961561ccb2c13adb864216eef00a4f30e2a59098e67ff48a46d0ab2fc319

  • SHA512

    a2d12db1b333da16c24e0bac03c12e5220aab8abd58f35d9427025854123f6b27e44eee8a087b76c2aaede9fa49c6203d380e6bee8d0f6693319aa2314587de1

  • SSDEEP

    6144:paBm1BXQfUhl7fTFMcbtYJ/b4UOIOV7izuo59fmgji:QBuBgfUhl7fTFRpeb4x1+9uD

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9d8346daea8edd2e86a54af5293d37a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9d8346daea8edd2e86a54af5293d37a_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2800-0-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/2800-1-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2800-2-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2800-7-0x0000000002050000-0x0000000002102000-memory.dmp

    Filesize

    712KB

  • memory/2800-3-0x0000000002050000-0x0000000002102000-memory.dmp

    Filesize

    712KB

  • memory/2800-5-0x0000000002050000-0x0000000002102000-memory.dmp

    Filesize

    712KB

  • memory/2800-13-0x0000000002050000-0x0000000002102000-memory.dmp

    Filesize

    712KB

  • memory/2800-14-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2800-11-0x0000000002050000-0x0000000002102000-memory.dmp

    Filesize

    712KB

  • memory/2800-9-0x0000000002050000-0x0000000002102000-memory.dmp

    Filesize

    712KB

  • memory/2800-15-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-19-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-17-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-42-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-44-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-47-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-53-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-69-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-71-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-66-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-64-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-43-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-41-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-81-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-45-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-84-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-46-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-48-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-49-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-51-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-86-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-85-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-83-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-82-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-80-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-79-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-78-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-77-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-76-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-75-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-74-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-73-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-72-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-70-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-68-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-67-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-65-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-63-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-62-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-61-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-60-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-59-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-58-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-57-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-56-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-55-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-54-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-52-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-50-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/2800-120-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/2800-122-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB