Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 21:27
Behavioral task
behavioral1
Sample
JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe
-
Size
1.4MB
-
MD5
37e859fdf2b248c9a753cc95ba6bb42a
-
SHA1
ea4110fdef55dfd969ca5ef7b56bfa321a6e4142
-
SHA256
4b1fa53e1acfb5a328d7af9a76809fe1277bd8d8a8cc43081607fc4929f6198e
-
SHA512
0dd39a6fcfbaf739032bd758016a5f8c72d59c6452559fb2141c87304e2bc4dd05cc9652dfe0209e6f986ab59790e1f329250eb30fc814ff4e7bf59ca0355d1a
-
SSDEEP
24576:ZxpXPaR2J33o3S7P5zuHHOF2ahfehMHsGKzOYf8EEvX3jZ10:jpy+VDa8rtPvX3jZy
Malware Config
Signatures
-
Socelars family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 iplogger.org 4 iplogger.org -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 2676 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeAssignPrimaryTokenPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeLockMemoryPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeIncreaseQuotaPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeMachineAccountPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeTcbPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeSecurityPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeTakeOwnershipPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeLoadDriverPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeSystemProfilePrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeSystemtimePrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeProfSingleProcessPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeIncBasePriorityPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeCreatePagefilePrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeCreatePermanentPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeBackupPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeRestorePrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeShutdownPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeDebugPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeAuditPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeSystemEnvironmentPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeChangeNotifyPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeRemoteShutdownPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeUndockPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeSyncAgentPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeEnableDelegationPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeManageVolumePrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeImpersonatePrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeCreateGlobalPrivilege 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: 31 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: 32 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: 33 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: 34 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: 35 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe Token: SeDebugPrivilege 2676 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2584 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe 28 PID 1876 wrote to memory of 2584 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe 28 PID 1876 wrote to memory of 2584 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe 28 PID 1876 wrote to memory of 2584 1876 JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe 28 PID 2584 wrote to memory of 2676 2584 cmd.exe 30 PID 2584 wrote to memory of 2676 2584 cmd.exe 30 PID 2584 wrote to memory of 2676 2584 cmd.exe 30 PID 2584 wrote to memory of 2676 2584 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_37e859fdf2b248c9a753cc95ba6bb42a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-