Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe
-
Size
240KB
-
MD5
ee14752b4ccb32769404996930ce3230
-
SHA1
09190329105e182ba82701fa0f7a731e49d4a832
-
SHA256
42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f
-
SHA512
15e5335cf214351f5ffb058fd8642018af62ed9e71f84ac42dc90d79f78755ac2d12abfc3716777ceaeb80cbc90a679cf32117741aa5e6d83e88a3a17763b264
-
SSDEEP
3072:NXMJhiithleXQDIQMoCrjXm0a477yPY5tT7/iuiRNOuzUlDCtut:NIsCeADtmrjX+0n/iTRUxj
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Tofsee family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\mazbspyl = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2872 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mazbspyl\ImagePath = "C:\\Windows\\SysWOW64\\mazbspyl\\gwrdxjnf.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2556 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2596 gwrdxjnf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2596 set thread context of 2556 2596 gwrdxjnf.exe 43 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2836 sc.exe 2900 sc.exe 2676 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gwrdxjnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2240 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 30 PID 3028 wrote to memory of 2240 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 30 PID 3028 wrote to memory of 2240 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 30 PID 3028 wrote to memory of 2240 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 30 PID 3028 wrote to memory of 2708 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 32 PID 3028 wrote to memory of 2708 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 32 PID 3028 wrote to memory of 2708 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 32 PID 3028 wrote to memory of 2708 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 32 PID 3028 wrote to memory of 2836 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 34 PID 3028 wrote to memory of 2836 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 34 PID 3028 wrote to memory of 2836 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 34 PID 3028 wrote to memory of 2836 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 34 PID 3028 wrote to memory of 2900 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 36 PID 3028 wrote to memory of 2900 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 36 PID 3028 wrote to memory of 2900 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 36 PID 3028 wrote to memory of 2900 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 36 PID 3028 wrote to memory of 2676 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 38 PID 3028 wrote to memory of 2676 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 38 PID 3028 wrote to memory of 2676 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 38 PID 3028 wrote to memory of 2676 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 38 PID 3028 wrote to memory of 2872 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 41 PID 3028 wrote to memory of 2872 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 41 PID 3028 wrote to memory of 2872 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 41 PID 3028 wrote to memory of 2872 3028 JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe 41 PID 2596 wrote to memory of 2556 2596 gwrdxjnf.exe 43 PID 2596 wrote to memory of 2556 2596 gwrdxjnf.exe 43 PID 2596 wrote to memory of 2556 2596 gwrdxjnf.exe 43 PID 2596 wrote to memory of 2556 2596 gwrdxjnf.exe 43 PID 2596 wrote to memory of 2556 2596 gwrdxjnf.exe 43 PID 2596 wrote to memory of 2556 2596 gwrdxjnf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mazbspyl\2⤵
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gwrdxjnf.exe" C:\Windows\SysWOW64\mazbspyl\2⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create mazbspyl binPath= "C:\Windows\SysWOW64\mazbspyl\gwrdxjnf.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description mazbspyl "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start mazbspyl2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2676
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2872
-
-
C:\Windows\SysWOW64\mazbspyl\gwrdxjnf.exeC:\Windows\SysWOW64\mazbspyl\gwrdxjnf.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42c7ced62147af5b8cc31c12cf3ef7d75dddaa518bf3f2beb2c7ab5d9c5dd64f.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.3MB
MD5e4159619e767b9fdc30d0a175ec9e19b
SHA1c4363b058f05f827caaaa4f12a268e7eeddb2907
SHA256d3b51884117a41e9003185fa9de633bc30902b3ccfc1a5d71fa1ccfac31f631a
SHA51269c5720d0c0f9981621ae007705ca5a3bcf65c9709ca14036327046cc29349f39c5e7d5d3f42cd8bec47c1edf143e81ec157de8a31fc3c76fab94e495dd4b4b1