Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2024, 21:50

General

  • Target

    JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe

  • Size

    560KB

  • MD5

    e9f403f6239418d0832fb1e1819ce81c

  • SHA1

    abcbf093072873578f5ad42cd33112ac924dd07a

  • SHA256

    b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8

  • SHA512

    167b916b54a3522ef3646350a953e2867c75bc8934bed1a6fb185e28bf6cd951176c6b7b7d61badd9de8a379ee805b9a1db8c626628d8451fc94683049074d61

  • SSDEEP

    12288:Qom4+pRCMP6uCgtrQ8bJ6uaEDiNusuJMQpQgxb+wf:vmdp4MP6arFV6uaEDSuYQpfxqa

Malware Config

Signatures

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot family
  • Trickbot x86 loader 8 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Roaming\DirectTools\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe
      C:\Users\Admin\AppData\Roaming\DirectTools\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:1708
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {CBD7B8C3-328D-4156-AEAA-F6707D6ABD8B} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Users\Admin\AppData\Roaming\DirectTools\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe
        C:\Users\Admin\AppData\Roaming\DirectTools\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          3⤵
            PID:1200

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Roaming\DirectTools\JaffaCakes118_b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8.exe

        Filesize

        560KB

        MD5

        e9f403f6239418d0832fb1e1819ce81c

        SHA1

        abcbf093072873578f5ad42cd33112ac924dd07a

        SHA256

        b5d0f4485aa0f3b43ae3ee9f0669209716143c1997f89c0cf2611a37501221f8

        SHA512

        167b916b54a3522ef3646350a953e2867c75bc8934bed1a6fb185e28bf6cd951176c6b7b7d61badd9de8a379ee805b9a1db8c626628d8451fc94683049074d61

      • memory/1200-30-0x0000000000060000-0x0000000000082000-memory.dmp

        Filesize

        136KB

      • memory/1200-29-0x0000000000060000-0x0000000000082000-memory.dmp

        Filesize

        136KB

      • memory/1708-18-0x0000000000060000-0x0000000000082000-memory.dmp

        Filesize

        136KB

      • memory/1708-20-0x0000000000060000-0x0000000000082000-memory.dmp

        Filesize

        136KB

      • memory/1960-28-0x0000000010000000-0x0000000010005000-memory.dmp

        Filesize

        20KB

      • memory/1960-26-0x0000000000970000-0x00000000009A1000-memory.dmp

        Filesize

        196KB

      • memory/1960-27-0x00000000003E0000-0x00000000003E1000-memory.dmp

        Filesize

        4KB

      • memory/1960-31-0x0000000000970000-0x00000000009A1000-memory.dmp

        Filesize

        196KB

      • memory/2188-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

        Filesize

        4KB

      • memory/2188-19-0x0000000000310000-0x0000000000341000-memory.dmp

        Filesize

        196KB

      • memory/2188-1-0x0000000000310000-0x0000000000341000-memory.dmp

        Filesize

        196KB

      • memory/2188-3-0x00000000002B0000-0x00000000002DF000-memory.dmp

        Filesize

        188KB

      • memory/2188-4-0x0000000000310000-0x0000000000341000-memory.dmp

        Filesize

        196KB

      • memory/2580-17-0x0000000010000000-0x0000000010005000-memory.dmp

        Filesize

        20KB

      • memory/2580-16-0x0000000000310000-0x0000000000311000-memory.dmp

        Filesize

        4KB

      • memory/2580-15-0x00000000002C0000-0x00000000002F1000-memory.dmp

        Filesize

        196KB

      • memory/2580-21-0x00000000002C0000-0x00000000002F1000-memory.dmp

        Filesize

        196KB