Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
fcb755961054f48694eb13170b93a195_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fcb755961054f48694eb13170b93a195_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fcb755961054f48694eb13170b93a195_JaffaCakes118.exe
-
Size
431KB
-
MD5
fcb755961054f48694eb13170b93a195
-
SHA1
42c2269f390a22b283ca72158a0481416a139107
-
SHA256
c864ec31f34d9628ff59965b1a43eb4ec2fa511a30d36fd45a862ff5efd7ad8e
-
SHA512
c367d4318525ec3cd45b69e55c32c814f48f881368ffaf90be78b830cd74c0eec4859615d201229a50e6d12c4f228361e182b800ade82378c4632282cc873f7c
-
SSDEEP
12288:6H2Bc9c+G8OVZqkPQItMi4IUbEbmEJyNVlmWweMMM:6HOkQPqkPQIB4IjJyNVNMMM
Malware Config
Extracted
gcleaner
ppp-gl.biz
45.9.20.13
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/5104-2-0x00000000024E0000-0x0000000002529000-memory.dmp family_onlylogger behavioral2/memory/5104-3-0x0000000000400000-0x000000000079D000-memory.dmp family_onlylogger behavioral2/memory/5104-4-0x0000000000400000-0x000000000079D000-memory.dmp family_onlylogger behavioral2/memory/5104-5-0x0000000000400000-0x000000000079D000-memory.dmp family_onlylogger behavioral2/memory/5104-7-0x00000000024E0000-0x0000000002529000-memory.dmp family_onlylogger -
Program crash 10 IoCs
pid pid_target Process procid_target 3776 5104 WerFault.exe 83 4028 5104 WerFault.exe 83 2528 5104 WerFault.exe 83 3004 5104 WerFault.exe 83 2144 5104 WerFault.exe 83 3740 5104 WerFault.exe 83 916 5104 WerFault.exe 83 2796 5104 WerFault.exe 83 624 5104 WerFault.exe 83 2512 5104 WerFault.exe 83 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5104 fcb755961054f48694eb13170b93a195_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcb755961054f48694eb13170b93a195_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fcb755961054f48694eb13170b93a195_JaffaCakes118.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 5002⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 6482⤵
- Program crash
PID:4028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 7402⤵
- Program crash
PID:2528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 7602⤵
- Program crash
PID:3004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 7522⤵
- Program crash
PID:2144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 5362⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 11002⤵
- Program crash
PID:916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 11522⤵
- Program crash
PID:2796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 8442⤵
- Program crash
PID:624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 11042⤵
- Program crash
PID:2512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5104 -ip 51041⤵PID:3440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5104 -ip 51041⤵PID:4972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5104 -ip 51041⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5104 -ip 51041⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5104 -ip 51041⤵PID:2532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5104 -ip 51041⤵PID:3616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5104 -ip 51041⤵PID:4888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5104 -ip 51041⤵PID:208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5104 -ip 51041⤵PID:3020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5104 -ip 51041⤵PID:444