Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe
-
Size
192KB
-
MD5
3fa3f1400f551f4cf1b3f81273000a63
-
SHA1
e79b7e390c9fd3cf6a0d1d9c7bb45efbf4aaa20a
-
SHA256
814249cc02eb6f7501cb41a070c60e1546472dc9b3b39ea69794f6435ab303a4
-
SHA512
d764403bb6f91028bc5a8216365e80a7999b7b5eb72ddb00c2ec10f9f25be4928c4d539659621ed00cd61013d7e8931eb69d91c117286afb2af5cac8db5e9256
-
SSDEEP
3072:JmbXnWKamWjtz/PiDad2Qq9SDxerZaJWRNjZ8S:eXnWKam+iDW2brf/jZ8
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x003b000000015dc0-5.dat family_gh0strat behavioral1/memory/2656-7-0x0000000010000000-0x0000000010028000-memory.dmp family_gh0strat -
Gh0strat family
-
Deletes itself 1 IoCs
pid Process 2656 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2656 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\arprbasimd svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~2\fpmsq\mjdjy.pic JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeBackupPrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeRestorePrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeBackupPrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeRestorePrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeBackupPrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeRestorePrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeBackupPrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeRestorePrivilege 3040 JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeSecurityPrivilege 2656 svchost.exe Token: SeSecurityPrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeSecurityPrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeSecurityPrivilege 2656 svchost.exe Token: SeBackupPrivilege 2656 svchost.exe Token: SeRestorePrivilege 2656 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fa3f1400f551f4cf1b3f81273000a63.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD542d0f92a4e95f459a3a86ea810fd66ce
SHA198dc69e0e564aa9a3f87cb72d1bd7ef0a241b6a8
SHA25688d0100a2b3d0c013a1841ad5a7f37ef26eae96de124f837ac9757174d98723c
SHA512ea4bceb87175dae9ab70627799dfe1000dac15684d68b8b41f225a8768e0ebe825ac7ed93122efd2a6b76e980ddacb01dd9661f0b0ab4850b52819d9623a572b