Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe
-
Size
305KB
-
MD5
780293db2a4e08f93a62476e02d21f27
-
SHA1
34263f7759ed4ee598240896339cbe4cac84624a
-
SHA256
2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213
-
SHA512
ffa7f48a2dc62beb86f2bbd0e37c60a41d8dadf4222a2593bb9bb6171c5326be5008bf96d00d65cdaeeae2923d9a4c93bbc781ddfeaefe1992b1f41a94a1b65e
-
SSDEEP
3072:VXYXu1MVDsY2mtCnIDqMKHf5pex3ElMFvlq17hZynkHIOE4Ru5TJftDunEvhtWGE:VX9MqYtcIA/5paGMFvlq7wRRtWhZl/7
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Tofsee family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hzgjfnib = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2428 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hzgjfnib\ImagePath = "C:\\Windows\\SysWOW64\\hzgjfnib\\wlyugfyk.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2628 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2196 wlyugfyk.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2196 set thread context of 2628 2196 wlyugfyk.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1240 sc.exe 1208 sc.exe 2200 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlyugfyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2108 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 28 PID 2440 wrote to memory of 2108 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 28 PID 2440 wrote to memory of 2108 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 28 PID 2440 wrote to memory of 2108 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 28 PID 2440 wrote to memory of 268 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 30 PID 2440 wrote to memory of 268 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 30 PID 2440 wrote to memory of 268 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 30 PID 2440 wrote to memory of 268 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 30 PID 2440 wrote to memory of 1240 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 32 PID 2440 wrote to memory of 1240 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 32 PID 2440 wrote to memory of 1240 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 32 PID 2440 wrote to memory of 1240 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 32 PID 2440 wrote to memory of 1208 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 34 PID 2440 wrote to memory of 1208 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 34 PID 2440 wrote to memory of 1208 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 34 PID 2440 wrote to memory of 1208 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 34 PID 2440 wrote to memory of 2200 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 36 PID 2440 wrote to memory of 2200 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 36 PID 2440 wrote to memory of 2200 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 36 PID 2440 wrote to memory of 2200 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 36 PID 2440 wrote to memory of 2428 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 39 PID 2440 wrote to memory of 2428 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 39 PID 2440 wrote to memory of 2428 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 39 PID 2440 wrote to memory of 2428 2440 JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe 39 PID 2196 wrote to memory of 2628 2196 wlyugfyk.exe 41 PID 2196 wrote to memory of 2628 2196 wlyugfyk.exe 41 PID 2196 wrote to memory of 2628 2196 wlyugfyk.exe 41 PID 2196 wrote to memory of 2628 2196 wlyugfyk.exe 41 PID 2196 wrote to memory of 2628 2196 wlyugfyk.exe 41 PID 2196 wrote to memory of 2628 2196 wlyugfyk.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hzgjfnib\2⤵
- System Location Discovery: System Language Discovery
PID:2108
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wlyugfyk.exe" C:\Windows\SysWOW64\hzgjfnib\2⤵
- System Location Discovery: System Language Discovery
PID:268
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hzgjfnib binPath= "C:\Windows\SysWOW64\hzgjfnib\wlyugfyk.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1240
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hzgjfnib "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1208
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hzgjfnib2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2200
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Windows\SysWOW64\hzgjfnib\wlyugfyk.exeC:\Windows\SysWOW64\hzgjfnib\wlyugfyk.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bea218f0d953d560a19d8aff8dfb4cd37fefe12e969982fcb031a8ef5725213.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.0MB
MD5005e2ed094a2e5de64756eb04a20c4c0
SHA195cf4891c470d78ed6dfc65ce36105a1058bbc6c
SHA256df6a08ab2a9034ca14a34c9ef3cad981425d60499b3e4ad153d6b9d18faeb082
SHA5127da72ebd732aa8236ebcf28167c2c429f4624aa30bff6626b5d87b9468734f9eabc091f31a734eb325445b7acc0c2a3f2234da7b7f3af48e501b2987588f8c07