Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2025, 12:40

General

  • Target

    JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe

  • Size

    180KB

  • MD5

    6a4534d55b16e33e76242c55eb6081c6

  • SHA1

    62af58275a49062511dfa9eb702af4273e7c3336

  • SHA256

    f01c2ded4c1a9924d31e1f3d8e3911863cefe22110cbbffc838e8a097539cd21

  • SHA512

    d771a39e3fccbcc42fb83ca4fa1b3b36552cdc40095af6c82c83cfcd8af8f7ef8670b9598b79fda80a2f76e8a6faf040f45b6f61c7839f54dfdff0fd366e2e44

  • SSDEEP

    3072:hnUyL7hUEhT5/atC/87CyZARCbU7TrNZl3nTu10:NUhEP/ACE7CEsx7dX3T3

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1120
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1172
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1220
          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe
            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a4534d55b16e33e76242c55eb6081c6.exe"
            2⤵
            • Modifies firewall policy service
            • Modifies visibility of file extensions in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2780
            • C:\Windows\SysWOW64\Explorer.exe
              Explorer
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2496
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1200

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Public\Documents\Top Pictures.exe

            Filesize

            180KB

            MD5

            6a4534d55b16e33e76242c55eb6081c6

            SHA1

            62af58275a49062511dfa9eb702af4273e7c3336

            SHA256

            f01c2ded4c1a9924d31e1f3d8e3911863cefe22110cbbffc838e8a097539cd21

            SHA512

            d771a39e3fccbcc42fb83ca4fa1b3b36552cdc40095af6c82c83cfcd8af8f7ef8670b9598b79fda80a2f76e8a6faf040f45b6f61c7839f54dfdff0fd366e2e44

          • memory/1120-16-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/2780-38-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-39-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-7-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-9-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-5-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-4-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-11-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-10-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-15-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-40-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-29-0x00000000003F0000-0x00000000003F2000-memory.dmp

            Filesize

            8KB

          • memory/2780-30-0x00000000003F0000-0x00000000003F2000-memory.dmp

            Filesize

            8KB

          • memory/2780-28-0x0000000000430000-0x0000000000431000-memory.dmp

            Filesize

            4KB

          • memory/2780-26-0x0000000000430000-0x0000000000431000-memory.dmp

            Filesize

            4KB

          • memory/2780-25-0x00000000003F0000-0x00000000003F2000-memory.dmp

            Filesize

            8KB

          • memory/2780-8-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-6-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-31-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-3-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-0-0x0000000000400000-0x000000000042D000-memory.dmp

            Filesize

            180KB

          • memory/2780-14-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-42-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-45-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-44-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-47-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-51-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-50-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-55-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-56-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-58-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-75-0x0000000002490000-0x0000000002492000-memory.dmp

            Filesize

            8KB

          • memory/2780-74-0x00000000003F0000-0x00000000003F2000-memory.dmp

            Filesize

            8KB

          • memory/2780-73-0x0000000002490000-0x0000000002492000-memory.dmp

            Filesize

            8KB

          • memory/2780-72-0x00000000024A0000-0x00000000024A1000-memory.dmp

            Filesize

            4KB

          • memory/2780-77-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-79-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-81-0x0000000002580000-0x000000000360E000-memory.dmp

            Filesize

            16.6MB

          • memory/2780-154-0x0000000000400000-0x000000000042D000-memory.dmp

            Filesize

            180KB