Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
ff181c2fde2ed1e091f9cf7a3fb5cb98_JaffaCakes118.jar
Resource
win7-20240903-en
General
-
Target
ff181c2fde2ed1e091f9cf7a3fb5cb98_JaffaCakes118.jar
-
Size
166KB
-
MD5
ff181c2fde2ed1e091f9cf7a3fb5cb98
-
SHA1
6471bf5f9a09a393eb9b8f64fde1b4c29ab77657
-
SHA256
68d86a6264814df91c2b58dd342fe9451134535d42eecbb623051ae616202912
-
SHA512
d18330c101882d0753afa1dbbce29c6479ec165383fac28f836c0cefb90a20e6cfc173eb512d897fe07b4bac9d7301471279b1b1bbff686e1633b2553719c0c2
-
SSDEEP
3072:92cMABeMv1CGzHNb3Ptbriienc5797SEwj1vSbSBEwemzD4sd4GF:92seMsStDPtPBRSPj1aPcEsb
Malware Config
Extracted
limerat
1Cs8MjxkXtYwkDKypg8i1Vj5nzhANpgC6y
-
aes_key
2249
-
antivm
false
-
c2_url
https://pastebin.com/raw/G9wX4J5m
-
delay
8
-
download_payload
false
-
install
true
-
install_name
player.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/G9wX4J5m
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Limerat family
-
Executes dropped EXE 2 IoCs
pid Process 1276 New-Client.exe 2736 player.exe -
Loads dropped DLL 2 IoCs
pid Process 1276 New-Client.exe 1276 New-Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 21 pastebin.com 20 pastebin.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New-Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language player.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2016 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2736 player.exe Token: SeDebugPrivilege 2736 player.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2652 2748 java.exe 31 PID 2748 wrote to memory of 2652 2748 java.exe 31 PID 2748 wrote to memory of 2652 2748 java.exe 31 PID 2652 wrote to memory of 2544 2652 wscript.exe 32 PID 2652 wrote to memory of 2544 2652 wscript.exe 32 PID 2652 wrote to memory of 2544 2652 wscript.exe 32 PID 2652 wrote to memory of 2580 2652 wscript.exe 33 PID 2652 wrote to memory of 2580 2652 wscript.exe 33 PID 2652 wrote to memory of 2580 2652 wscript.exe 33 PID 2544 wrote to memory of 1276 2544 WScript.exe 34 PID 2544 wrote to memory of 1276 2544 WScript.exe 34 PID 2544 wrote to memory of 1276 2544 WScript.exe 34 PID 2544 wrote to memory of 1276 2544 WScript.exe 34 PID 1276 wrote to memory of 2016 1276 New-Client.exe 36 PID 1276 wrote to memory of 2016 1276 New-Client.exe 36 PID 1276 wrote to memory of 2016 1276 New-Client.exe 36 PID 1276 wrote to memory of 2016 1276 New-Client.exe 36 PID 1276 wrote to memory of 2736 1276 New-Client.exe 38 PID 1276 wrote to memory of 2736 1276 New-Client.exe 38 PID 1276 wrote to memory of 2736 1276 New-Client.exe 38 PID 1276 wrote to memory of 2736 1276 New-Client.exe 38
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ff181c2fde2ed1e091f9cf7a3fb5cb98_JaffaCakes118.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\wscript.exewscript C:\Users\Admin\xkxsxewbpw.js2⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\oVxRAoYHJl.js"3⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Roaming\New-Client.exe"C:\Users\Admin\AppData\Roaming\New-Client.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2016
-
-
C:\Users\Admin\AppData\Roaming\player.exe"C:\Users\Admin\AppData\Roaming\player.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\hzedeoyb.txt"3⤵PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD51ad564a6ca1520e8886faffc4e0ff1d4
SHA17d3b61daef1afed73838351dbf788448cf88d031
SHA2562c3a771c2ecbd58409c3f348220c5d9419901e882c61531b68e07b80eb0d3df4
SHA512b54d6cb92876546c38503e5e673d765f2e323246f5adbaefa83cdc62af6a462d117d3dc183666f902a84575590aa02f94d9997e7783e6f99050c57a710fab441
-
Filesize
92KB
MD5d89bd5c794363237602a61b057673299
SHA13d37e97124b25fe0c955f880cfc7e0004809e2ac
SHA256e038e94963e067ccda7e6df50965a117dd14603cddf0082e0759c6eb134549f4
SHA512106dfa9ca06437317712386852c85d950bd9c07e67fee91a6b3aacce49c7012abfb8dc6dfff74a53203772706e1609fe41d10ecb2c861795ee61fd502bada35d
-
Filesize
53KB
MD53bb731a281fc7a55c9c7b8f192568c5a
SHA1c31fe3483d2210876fd6b60ccbd65b4cc4d340d3
SHA2561c9ffe5682dcf0a68f10d49d1ac6eea187f8afc2a5b99881654fdd83f37759ef
SHA512803eef5aacc2d1feef93c5130297faa6af66903682fdd1871c281b6770d0c025e50f61ee3d99c96e146e13b30777efe07bfe5c5d5b2548cdcea26aceca75b683
-
Filesize
278KB
MD5429911446e5f159495309d0290cb654c
SHA1c75f6e784a1be339c92d356e200df1922c3a303b
SHA2561c8942fcadb3b76905b0b71d267730f1f1bd26befe0d512a3fc8d9bab25b6289
SHA51228bf47f7d25ce3cab61dda34df71a707824e72370a18f3ebe3f93e14013be17ffc7e61193d8f99f51499337d212fe201d45e2d81e0bb6f3135bb6d75cb4b0789