Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2025, 09:37

General

  • Target

    JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe

  • Size

    847KB

  • MD5

    9b288f1ed4b43253489dbd03b8902445

  • SHA1

    1aaaf8dcc605ec1ce72bbadea6655ce26eb31517

  • SHA256

    fe68fa8aa8522badacc0c97554cd4a1b8d466dd16dc61b86542e799db0d1f7ae

  • SHA512

    e22b548195c3528869d0f67b0036fab1f95c6f74e70a8b77b829822487916e99c5fe12b49635856c667ee78a459163dbdb899c0833d9c8502246180b74096db1

  • SSDEEP

    12288:TaOZoS4FJfBSkkkkkkkkkkkkkkx9L+kIkkvkkkkkkkk7ZLmfKWYEh2JmDt1J3y/R:QXklIKyWYI2IhfYl12Hk

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hs3h

Decoy

slairt.com

teresasellsflorida.com

resouthcarolina.com

npccfbf.com

hutshed.com

westatesmarking.com

rustmonkeys.com

kagawa-rentacar.com

easyvoip-system.com

admorinsulation.com

ericaleighjensen.com

zhonghaojiaju.net

apple-iphone.xyz

b0t.info

torgetmc.xyz

lawrencemargarse.com

6123655.com

macdonalds-delivery.com

cvpfl.com

ayudaparaturent.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yteSoDKQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46E0.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2828
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9b288f1ed4b43253489dbd03b8902445.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp46E0.tmp

    Filesize

    1KB

    MD5

    ae35a490438b8476df1c26742c0c4183

    SHA1

    4c8d8abe11b6b8aaa3405f55efed40f5dc089bb2

    SHA256

    1765b6b01aa07cbd974a5c7c6e1f4611bd6c934d7cce8ed06cb8c238e5ce2568

    SHA512

    9fc1e6dc17b9c55150a77f504771c75d9f3149199e3a0d2a88f1aebf3d532587376233668219acc106c18a9844fd13b7dfd4d3c51d4705ed7460a4c67733e971

  • memory/2864-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2864-12-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2864-18-0x0000000000A20000-0x0000000000D23000-memory.dmp

    Filesize

    3.0MB

  • memory/2864-16-0x0000000000A20000-0x0000000000D23000-memory.dmp

    Filesize

    3.0MB

  • memory/2864-15-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2864-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3060-5-0x0000000074260000-0x000000007494E000-memory.dmp

    Filesize

    6.9MB

  • memory/3060-2-0x0000000074260000-0x000000007494E000-memory.dmp

    Filesize

    6.9MB

  • memory/3060-7-0x0000000000580000-0x00000000005B4000-memory.dmp

    Filesize

    208KB

  • memory/3060-6-0x0000000004F00000-0x0000000004F8A000-memory.dmp

    Filesize

    552KB

  • memory/3060-1-0x0000000000F30000-0x0000000001008000-memory.dmp

    Filesize

    864KB

  • memory/3060-0-0x000000007426E000-0x000000007426F000-memory.dmp

    Filesize

    4KB

  • memory/3060-4-0x000000007426E000-0x000000007426F000-memory.dmp

    Filesize

    4KB

  • memory/3060-17-0x0000000074260000-0x000000007494E000-memory.dmp

    Filesize

    6.9MB

  • memory/3060-3-0x0000000000250000-0x0000000000264000-memory.dmp

    Filesize

    80KB