Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe
-
Size
436KB
-
MD5
f417a42407e03aa745b6eceeb4994b7c
-
SHA1
33f6be92bc9cc096c4ed5f4a27b5da7fce790e8c
-
SHA256
7c6528ddebf48f0199d66b42f5d38452c4665638c33d918392c4cb0b4dd4f24f
-
SHA512
05201d549682963c9a77ec644fe1d860a3b3dbc54df09d2731492ce05e67bb7a4abc80dfe561808f1faae27a9a1e7a859bd2d1df4ea08237f11325b13d7c3cb5
-
SSDEEP
12288:ZVYrj0c2rNKuY47UjZ5nW98tIAKbFK9mp6atb:gnNKNK/47M5nW9nAkKo5
Malware Config
Extracted
gcleaner
ggg-cl.biz
45.9.20.13
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
resource yara_rule behavioral1/memory/1044-2-0x0000000000230000-0x0000000000278000-memory.dmp family_onlylogger behavioral1/memory/1044-3-0x0000000000400000-0x00000000016E0000-memory.dmp family_onlylogger behavioral1/memory/1044-4-0x0000000000400000-0x00000000016E0000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 3040 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3032 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3032 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3040 1044 f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe 28 PID 1044 wrote to memory of 3040 1044 f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe 28 PID 1044 wrote to memory of 3040 1044 f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe 28 PID 1044 wrote to memory of 3040 1044 f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe 28 PID 3040 wrote to memory of 3032 3040 cmd.exe 30 PID 3040 wrote to memory of 3032 3040 cmd.exe 30 PID 3040 wrote to memory of 3032 3040 cmd.exe 30 PID 3040 wrote to memory of 3032 3040 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "f417a42407e03aa745b6eceeb4994b7c_JaffaCakes118.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-