Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 01:00
Behavioral task
behavioral1
Sample
JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe
-
Size
21KB
-
MD5
7761039c57357d06bd4bee421fe6aeb8
-
SHA1
110ab0dcd07bab99b71b863e3dda9dc74ccfb20f
-
SHA256
58e9c5e1b595081208c8ef403150121b9aeda5411df545d0f3d3a256c3f57d19
-
SHA512
cb02788eee2f6d5d5e40d63e806318def7b5aad9fbcff62669e3445a6e6a835239f02fcefc54b1afa395a2b816b565762922e798f3170675ae48f59bc5f0c669
-
SSDEEP
384:uIdmF+TH95xJMu/0PlxjV8BINhuLJ37tMOpuqqz3KK7eIVmi4+fdct09UyBrpLR:uIsF8HdbKjV8BX7Vy6K7eIVThdcCUA
Malware Config
Extracted
xtremerat
2.no-ip.biz
Signatures
-
Detect XtremeRAT payload 4 IoCs
resource yara_rule behavioral1/memory/2152-6-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2160-10-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2576-11-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat behavioral1/memory/2160-13-0x0000000000C80000-0x0000000000C96000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27071777-S70G-NYV7-4K1O-BTQ623E547VO}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{27071777-S70G-NYV7-4K1O-BTQ623E547VO} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{27071777-S70G-NYV7-4K1O-BTQ623E547VO}\StubPath = "C:\\Windows\\system32\\InstallDir\\Server.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{27071777-S70G-NYV7-4K1O-BTQ623E547VO} JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Server.exe" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Server.exe JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe File created C:\Windows\SysWOW64\InstallDir\Server.exe JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe -
resource yara_rule behavioral1/memory/2576-0-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2152-6-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/files/0x00070000000186d9-7.dat upx behavioral1/memory/2160-10-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2576-11-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral1/memory/2160-13-0x0000000000C80000-0x0000000000C96000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2160 notepad.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2576 wrote to memory of 2152 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 29 PID 2576 wrote to memory of 2152 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 29 PID 2576 wrote to memory of 2152 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 29 PID 2576 wrote to memory of 2152 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 29 PID 2576 wrote to memory of 2152 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 29 PID 2576 wrote to memory of 2160 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 30 PID 2576 wrote to memory of 2160 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 30 PID 2576 wrote to memory of 2160 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 30 PID 2576 wrote to memory of 2160 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 30 PID 2576 wrote to memory of 2160 2576 JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7761039c57357d06bd4bee421fe6aeb8.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2152
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD57761039c57357d06bd4bee421fe6aeb8
SHA1110ab0dcd07bab99b71b863e3dda9dc74ccfb20f
SHA25658e9c5e1b595081208c8ef403150121b9aeda5411df545d0f3d3a256c3f57d19
SHA512cb02788eee2f6d5d5e40d63e806318def7b5aad9fbcff62669e3445a6e6a835239f02fcefc54b1afa395a2b816b565762922e798f3170675ae48f59bc5f0c669