Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe
-
Size
822KB
-
MD5
47c480f6a636913a27bb0dbab75a9452
-
SHA1
9a5a08d65f9d000da79e467aa39a09cfd02dfde3
-
SHA256
96049276ea392f92dea7de04988daf9d924f93a1186171a90f428d819c671dc4
-
SHA512
f4a537a6db5928e1064a582ac4d43597f67797ec020c03e6f8c44fbecf5b58e802c9fd0e6d5b868a741171a5f02814b11fba6589f1d9e85cc516b4c19980784d
-
SSDEEP
24576:3fc7wHBTZDibQCI6Vd2Qy68pCx2U5aaUld:3fMGdAbl8Qy1W22ah
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2104-3-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat behavioral1/memory/2104-5-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat behavioral1/memory/2104-7-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat behavioral1/memory/2104-9-0x0000000010000000-0x0000000010046000-memory.dmp family_gh0strat -
Gh0strat family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\064951F8 = "C:\\Windows\\064951F8\\svchsot.exe" JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
System Service Discovery 1 TTPs 2 IoCs
Adversaries may try to gather information about registered local system services.
pid Process 1892 net.exe 2804 net1.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1892 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 30 PID 2104 wrote to memory of 1892 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 30 PID 2104 wrote to memory of 1892 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 30 PID 2104 wrote to memory of 1892 2104 JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe 30 PID 1892 wrote to memory of 2804 1892 net.exe 32 PID 1892 wrote to memory of 2804 1892 net.exe 32 PID 1892 wrote to memory of 2804 1892 net.exe 32 PID 1892 wrote to memory of 2804 1892 net.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47c480f6a636913a27bb0dbab75a9452.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\net.exenet start "Task Scheduler"2⤵
- System Location Discovery: System Language Discovery
- System Service Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Task Scheduler"3⤵
- System Location Discovery: System Language Discovery
- System Service Discovery
PID:2804
-
-