Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2025, 22:35 UTC

General

  • Target

    JaffaCakes118_5c035eabdc210ca5992e0017d715d8fc.exe

  • Size

    97KB

  • MD5

    5c035eabdc210ca5992e0017d715d8fc

  • SHA1

    3677a09367dc6396106b08822875f5e9b5dee241

  • SHA256

    14c1c6de7508c0fe8e4006c6df6bd68aab13041fe779412ced195682682410f9

  • SHA512

    0c83cd7a093160fa0a7e9eb88f688dc835f677cc44f4b719584101045298ea79df07447efc01b1917845f4554f531e0270ae03ef86efa400f19b14824e108273

  • SSDEEP

    3072:G8edsTFUm9g0F8j/aUuPfomsLD46GwzpDLDqfeWZx:GSZF8FMo7L4wztceWT

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:808
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:812
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:388
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:3076
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3140
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3236
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3512
                  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c035eabdc210ca5992e0017d715d8fc.exe
                    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c035eabdc210ca5992e0017d715d8fc.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3788
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3664
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3856
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3944
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:4036
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:2524
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4160
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:3380
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4584
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                  1⤵
                                    PID:708
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                    1⤵
                                      PID:1544
                                    • C:\Windows\system32\BackgroundTaskHost.exe
                                      "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                      1⤵
                                        PID:4000
                                      • C:\Windows\System32\RuntimeBroker.exe
                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                        1⤵
                                          PID:780
                                        • C:\Windows\System32\RuntimeBroker.exe
                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          1⤵
                                            PID:1440

                                          Network

                                          • flag-us
                                            DNS
                                            67.31.126.40.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            67.31.126.40.in-addr.arpa
                                            IN PTR
                                            Response
                                          • flag-us
                                            DNS
                                            172.214.232.199.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            172.214.232.199.in-addr.arpa
                                            IN PTR
                                            Response
                                          • flag-us
                                            DNS
                                            55.36.223.20.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            55.36.223.20.in-addr.arpa
                                            IN PTR
                                            Response
                                          • flag-us
                                            DNS
                                            212.20.149.52.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            212.20.149.52.in-addr.arpa
                                            IN PTR
                                            Response
                                          • flag-us
                                            DNS
                                            241.42.69.40.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            241.42.69.40.in-addr.arpa
                                            IN PTR
                                            Response
                                          • flag-us
                                            DNS
                                            11.153.16.2.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            11.153.16.2.in-addr.arpa
                                            IN PTR
                                            Response
                                            11.153.16.2.in-addr.arpa
                                            IN PTR
                                            a2-16-153-11deploystaticakamaitechnologiescom
                                          • flag-us
                                            DNS
                                            14.227.111.52.in-addr.arpa
                                            Remote address:
                                            8.8.8.8:53
                                            Request
                                            14.227.111.52.in-addr.arpa
                                            IN PTR
                                            Response
                                          No results found
                                          • 8.8.8.8:53
                                            67.31.126.40.in-addr.arpa
                                            dns
                                            71 B
                                            157 B
                                            1
                                            1

                                            DNS Request

                                            67.31.126.40.in-addr.arpa

                                          • 8.8.8.8:53
                                            172.214.232.199.in-addr.arpa
                                            dns
                                            74 B
                                            128 B
                                            1
                                            1

                                            DNS Request

                                            172.214.232.199.in-addr.arpa

                                          • 8.8.8.8:53
                                            55.36.223.20.in-addr.arpa
                                            dns
                                            71 B
                                            157 B
                                            1
                                            1

                                            DNS Request

                                            55.36.223.20.in-addr.arpa

                                          • 8.8.8.8:53
                                            212.20.149.52.in-addr.arpa
                                            dns
                                            72 B
                                            146 B
                                            1
                                            1

                                            DNS Request

                                            212.20.149.52.in-addr.arpa

                                          • 8.8.8.8:53
                                            241.42.69.40.in-addr.arpa
                                            dns
                                            71 B
                                            145 B
                                            1
                                            1

                                            DNS Request

                                            241.42.69.40.in-addr.arpa

                                          • 8.8.8.8:53
                                            11.153.16.2.in-addr.arpa
                                            dns
                                            70 B
                                            133 B
                                            1
                                            1

                                            DNS Request

                                            11.153.16.2.in-addr.arpa

                                          • 8.8.8.8:53
                                            14.227.111.52.in-addr.arpa
                                            dns
                                            72 B
                                            158 B
                                            1
                                            1

                                            DNS Request

                                            14.227.111.52.in-addr.arpa

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\lomjix.pif

                                            Filesize

                                            97KB

                                            MD5

                                            2a79fd914ba1b647bbe011dd54853aed

                                            SHA1

                                            4b1cf9c157bdfae9b346b1a6a96c93b323ec24c8

                                            SHA256

                                            bb1574c844b27cd0879f667470845e9a53fa745d5c15200f1106c1983bbf6a6a

                                            SHA512

                                            452a69008e1313abea1a46bca750033fef1a7fb32e9dd848b24464a9bca7117db26dd60256cfb836c7a532bcc20cf5b33eee58b8b3701753209db97446bb3392

                                          • memory/3788-29-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-22-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-4-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-5-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-7-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-6-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-18-0x0000000004980000-0x0000000004981000-memory.dmp

                                            Filesize

                                            4KB

                                          • memory/3788-19-0x0000000003FD0000-0x0000000003FD2000-memory.dmp

                                            Filesize

                                            8KB

                                          • memory/3788-20-0x0000000003FD0000-0x0000000003FD2000-memory.dmp

                                            Filesize

                                            8KB

                                          • memory/3788-16-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-15-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-17-0x0000000003FD0000-0x0000000003FD2000-memory.dmp

                                            Filesize

                                            8KB

                                          • memory/3788-14-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-8-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-21-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-32-0x0000000003FD0000-0x0000000003FD2000-memory.dmp

                                            Filesize

                                            8KB

                                          • memory/3788-23-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-25-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-24-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-27-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-28-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-0-0x0000000000400000-0x0000000000412000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/3788-3-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-31-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-65-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-35-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-36-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-40-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-41-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-44-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-45-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-53-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-54-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-55-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-56-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-60-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-61-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-63-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-33-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-68-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-70-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-71-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-72-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-75-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-1-0x0000000000800000-0x00000000018BA000-memory.dmp

                                            Filesize

                                            16.7MB

                                          • memory/3788-86-0x0000000000400000-0x0000000000412000-memory.dmp

                                            Filesize

                                            72KB

                                          We care about your privacy.

                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.