Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
ff1aa31f4f6715bfef4d623cede134b2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff1aa31f4f6715bfef4d623cede134b2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff1aa31f4f6715bfef4d623cede134b2_JaffaCakes118.exe
-
Size
265KB
-
MD5
ff1aa31f4f6715bfef4d623cede134b2
-
SHA1
4500642f61626fd7cd4fa471169619460eeed7d2
-
SHA256
aa9b6dcb936a8fe6826e12fbf628c3ca0c85b5eede66c450ff3b4838a84dcc2b
-
SHA512
e1f46c46d3ae5e21c9c53e57470824f3d26f797684ed5b088d146324c736508b87f094354cb3f5c6ae0f69f1423d69455adf60d4d551515f2607f626b550f49a
-
SSDEEP
3072:yqnuKBRTUZWtKkKjCS7jsiGTUexestDFP3ZgX7F7CKSuXYxUfJhse+VCI4K+iZPb:yqnu4DtKmSfsiUUerPI71SXWwehBiB
Malware Config
Extracted
gcleaner
ggg-cl.biz
45.9.20.13
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 4 IoCs
resource yara_rule behavioral2/memory/2140-2-0x00000000001C0000-0x00000000001EF000-memory.dmp family_onlylogger behavioral2/memory/2140-3-0x0000000000400000-0x0000000002B82000-memory.dmp family_onlylogger behavioral2/memory/2140-4-0x0000000000400000-0x0000000002B82000-memory.dmp family_onlylogger behavioral2/memory/2140-7-0x00000000001C0000-0x00000000001EF000-memory.dmp family_onlylogger