Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2024, 18:42

General

  • Target

    f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe

  • Size

    436KB

  • MD5

    f417a42407e03aa745b6eceeb4994b7c

  • SHA1

    33f6be92bc9cc096c4ed5f4a27b5da7fce790e8c

  • SHA256

    7c6528ddebf48f0199d66b42f5d38452c4665638c33d918392c4cb0b4dd4f24f

  • SHA512

    05201d549682963c9a77ec644fe1d860a3b3dbc54df09d2731492ce05e67bb7a4abc80dfe561808f1faae27a9a1e7a859bd2d1df4ea08237f11325b13d7c3cb5

  • SSDEEP

    12288:ZVYrj0c2rNKuY47UjZ5nW98tIAKbFK9mp6atb:gnNKNK/47M5nW9nAkKo5

Malware Config

Extracted

Family

gcleaner

C2

ggg-cl.biz

45.9.20.13

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger payload 3 IoCs
  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe" & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-2-0x0000000000230000-0x0000000000278000-memory.dmp

    Filesize

    288KB

  • memory/1044-1-0x00000000018B0000-0x00000000019B0000-memory.dmp

    Filesize

    1024KB

  • memory/1044-3-0x0000000000400000-0x00000000016E0000-memory.dmp

    Filesize

    18.9MB

  • memory/1044-4-0x0000000000400000-0x00000000016E0000-memory.dmp

    Filesize

    18.9MB