Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
ff181c2fde2ed1e091f9cf7a3fb5cb98_JaffaCakes118.jar
Resource
win7-20240903-en
General
-
Target
ff181c2fde2ed1e091f9cf7a3fb5cb98_JaffaCakes118.jar
-
Size
166KB
-
MD5
ff181c2fde2ed1e091f9cf7a3fb5cb98
-
SHA1
6471bf5f9a09a393eb9b8f64fde1b4c29ab77657
-
SHA256
68d86a6264814df91c2b58dd342fe9451134535d42eecbb623051ae616202912
-
SHA512
d18330c101882d0753afa1dbbce29c6479ec165383fac28f836c0cefb90a20e6cfc173eb512d897fe07b4bac9d7301471279b1b1bbff686e1633b2553719c0c2
-
SSDEEP
3072:92cMABeMv1CGzHNb3Ptbriienc5797SEwj1vSbSBEwemzD4sd4GF:92seMsStDPtPBRSPj1aPcEsb
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/G9wX4J5m
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Limerat family
-
Strrat family
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation New-Client.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apcfni.txt java.exe -
Executes dropped EXE 2 IoCs
pid Process 2180 New-Client.exe 2040 player.exe -
Loads dropped DLL 2 IoCs
pid Process 3012 java.exe 4864 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apcfni = "\"C:\\Users\\Admin\\AppData\\Roaming\\apcfni.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apcfni = "\"C:\\Users\\Admin\\AppData\\Roaming\\apcfni.txt\"" java.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 28 pastebin.com 29 pastebin.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language player.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New-Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings wscript.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1224 schtasks.exe 3308 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2040 player.exe Token: SeDebugPrivilege 2040 player.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2372 wrote to memory of 4688 2372 java.exe 86 PID 2372 wrote to memory of 4688 2372 java.exe 86 PID 4688 wrote to memory of 4828 4688 wscript.exe 87 PID 4688 wrote to memory of 4828 4688 wscript.exe 87 PID 4688 wrote to memory of 4616 4688 wscript.exe 88 PID 4688 wrote to memory of 4616 4688 wscript.exe 88 PID 4828 wrote to memory of 2180 4828 WScript.exe 89 PID 4828 wrote to memory of 2180 4828 WScript.exe 89 PID 4828 wrote to memory of 2180 4828 WScript.exe 89 PID 4616 wrote to memory of 3012 4616 javaw.exe 91 PID 4616 wrote to memory of 3012 4616 javaw.exe 91 PID 3012 wrote to memory of 696 3012 java.exe 93 PID 3012 wrote to memory of 696 3012 java.exe 93 PID 3012 wrote to memory of 4864 3012 java.exe 94 PID 3012 wrote to memory of 4864 3012 java.exe 94 PID 696 wrote to memory of 1224 696 cmd.exe 97 PID 696 wrote to memory of 1224 696 cmd.exe 97 PID 2180 wrote to memory of 3308 2180 New-Client.exe 100 PID 2180 wrote to memory of 3308 2180 New-Client.exe 100 PID 2180 wrote to memory of 3308 2180 New-Client.exe 100 PID 2180 wrote to memory of 2040 2180 New-Client.exe 102 PID 2180 wrote to memory of 2040 2180 New-Client.exe 102 PID 2180 wrote to memory of 2040 2180 New-Client.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ff181c2fde2ed1e091f9cf7a3fb5cb98_JaffaCakes118.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\xkxsxewbpw.js2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\oVxRAoYHJl.js"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Roaming\New-Client.exe"C:\Users\Admin\AppData\Roaming\New-Client.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\player.exe'"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3308
-
-
C:\Users\Admin\AppData\Roaming\player.exe"C:\Users\Admin\AppData\Roaming\player.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\apcfni.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\apcfni.txt"4⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\apcfni.txt"5⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\apcfni.txt"6⤵
- Scheduled Task/Job: Scheduled Task
PID:1224
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\apcfni.txt"5⤵
- Loads dropped DLL
PID:4864
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241KB
MD5e02979ecd43bcc9061eb2b494ab5af50
SHA13122ac0e751660f646c73b10c4f79685aa65c545
SHA256a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a
SHA5121e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-493223053-2004649691-1575712786-1000\83aa4cc77f591dfc2374580bbd95f6ba_755b0f1a-bb38-4bb2-bc7e-240c892146ee
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
28KB
MD51ad564a6ca1520e8886faffc4e0ff1d4
SHA17d3b61daef1afed73838351dbf788448cf88d031
SHA2562c3a771c2ecbd58409c3f348220c5d9419901e882c61531b68e07b80eb0d3df4
SHA512b54d6cb92876546c38503e5e673d765f2e323246f5adbaefa83cdc62af6a462d117d3dc183666f902a84575590aa02f94d9997e7783e6f99050c57a710fab441
-
Filesize
92KB
MD5d89bd5c794363237602a61b057673299
SHA13d37e97124b25fe0c955f880cfc7e0004809e2ac
SHA256e038e94963e067ccda7e6df50965a117dd14603cddf0082e0759c6eb134549f4
SHA512106dfa9ca06437317712386852c85d950bd9c07e67fee91a6b3aacce49c7012abfb8dc6dfff74a53203772706e1609fe41d10ecb2c861795ee61fd502bada35d
-
Filesize
53KB
MD53bb731a281fc7a55c9c7b8f192568c5a
SHA1c31fe3483d2210876fd6b60ccbd65b4cc4d340d3
SHA2561c9ffe5682dcf0a68f10d49d1ac6eea187f8afc2a5b99881654fdd83f37759ef
SHA512803eef5aacc2d1feef93c5130297faa6af66903682fdd1871c281b6770d0c025e50f61ee3d99c96e146e13b30777efe07bfe5c5d5b2548cdcea26aceca75b683
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
Filesize
278KB
MD5429911446e5f159495309d0290cb654c
SHA1c75f6e784a1be339c92d356e200df1922c3a303b
SHA2561c8942fcadb3b76905b0b71d267730f1f1bd26befe0d512a3fc8d9bab25b6289
SHA51228bf47f7d25ce3cab61dda34df71a707824e72370a18f3ebe3f93e14013be17ffc7e61193d8f99f51499337d212fe201d45e2d81e0bb6f3135bb6d75cb4b0789