Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe
-
Size
361KB
-
MD5
0d0d6d2d6edb381091bc23ad11694d46
-
SHA1
6c1cbbe7b0a36b63639a4f89281889bad8fb117e
-
SHA256
daea32c4e86421247045c51958e42225d0e335af5b2d18f28ab709f14076fa40
-
SHA512
02825af03546580e016f4c1e34c8de198e4040a1f072171007caa91b1e306652b60556502956df38740f7b700bdb736c886156783e2e456508c3201e117fff32
-
SSDEEP
6144:ovfaRGQv+gswXbBXWMqyLV/piuy2MNxONPRFJBKPLaqEWRaiW6XEozuUU:oHwPpswXlXaI/pNy2XJpIPLapWIiWYN
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral1/memory/2000-2-0x0000000000220000-0x0000000000268000-memory.dmp family_onlylogger behavioral1/memory/2000-3-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral1/memory/2000-6-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral1/memory/2000-5-0x0000000000220000-0x0000000000268000-memory.dmp family_onlylogger behavioral1/memory/2000-4-0x0000000000400000-0x000000000088A000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 2928 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2564 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2564 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2928 2000 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 28 PID 2000 wrote to memory of 2928 2000 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 28 PID 2000 wrote to memory of 2928 2000 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 28 PID 2000 wrote to memory of 2928 2000 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 28 PID 2928 wrote to memory of 2564 2928 cmd.exe 30 PID 2928 wrote to memory of 2564 2928 cmd.exe 30 PID 2928 wrote to memory of 2564 2928 cmd.exe 30 PID 2928 wrote to memory of 2564 2928 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-