Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 09:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
Resource
win7-20240319-en
3 signatures
150 seconds
General
-
Target
ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe
-
Size
462KB
-
MD5
ed20a01ec2d93943bd0664fafb76daa6
-
SHA1
4736f0170c32b4757e062eb6b1d47d46c7d5ab29
-
SHA256
5bc02ebc009910c9625991d64f2170d0c1ddd2b403d34674e3b48e8fd0f22242
-
SHA512
b22360f22bb48529b2b986f7ef37eb9d1cdb42eaaea7fa44b93fc48a0f2b02ee4d4029d1d0e80867ce0a8d8a322f9c463182910c83cc36d4b53fb2c50c470ccf
-
SSDEEP
12288:+kRfdSeBVKuvlfIGLUzA9iP+ngOu4sl4OxCDi:PfnKu9fIGYzA4PyXOAi
Malware Config
Signatures
-
Raccoon Stealer V1 payload 4 IoCs
resource yara_rule behavioral2/memory/968-2-0x0000000004B00000-0x0000000004B91000-memory.dmp family_raccoon_v1 behavioral2/memory/968-3-0x0000000000400000-0x0000000002D01000-memory.dmp family_raccoon_v1 behavioral2/memory/968-4-0x0000000000400000-0x0000000002D01000-memory.dmp family_raccoon_v1 behavioral2/memory/968-7-0x0000000004B00000-0x0000000004B91000-memory.dmp family_raccoon_v1 -
Program crash 6 IoCs
pid pid_target Process procid_target 4296 968 WerFault.exe 83 4720 968 WerFault.exe 83 1120 968 WerFault.exe 83 2316 968 WerFault.exe 83 3520 968 WerFault.exe 83 4316 968 WerFault.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed20a01ec2d93943bd0664fafb76daa6_JaffaCakes118.exe"1⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 7402⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 7762⤵
- Program crash
PID:4720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 7562⤵
- Program crash
PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 7842⤵
- Program crash
PID:2316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 11962⤵
- Program crash
PID:3520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 12082⤵
- Program crash
PID:4316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 968 -ip 9681⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 968 -ip 9681⤵PID:2392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 968 -ip 9681⤵PID:3468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 968 -ip 9681⤵PID:3288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 968 -ip 9681⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 968 -ip 9681⤵PID:3972