Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe
-
Size
361KB
-
MD5
0d0d6d2d6edb381091bc23ad11694d46
-
SHA1
6c1cbbe7b0a36b63639a4f89281889bad8fb117e
-
SHA256
daea32c4e86421247045c51958e42225d0e335af5b2d18f28ab709f14076fa40
-
SHA512
02825af03546580e016f4c1e34c8de198e4040a1f072171007caa91b1e306652b60556502956df38740f7b700bdb736c886156783e2e456508c3201e117fff32
-
SSDEEP
6144:ovfaRGQv+gswXbBXWMqyLV/piuy2MNxONPRFJBKPLaqEWRaiW6XEozuUU:oHwPpswXlXaI/pNy2XJpIPLapWIiWYN
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 6 IoCs
resource yara_rule behavioral2/memory/1420-2-0x0000000000960000-0x00000000009A8000-memory.dmp family_onlylogger behavioral2/memory/1420-3-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral2/memory/1420-4-0x0000000000400000-0x000000000088A000-memory.dmp family_onlylogger behavioral2/memory/1420-6-0x0000000000400000-0x000000000088A000-memory.dmp family_onlylogger behavioral2/memory/1420-8-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral2/memory/1420-7-0x0000000000960000-0x00000000009A8000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 4724 1420 WerFault.exe 90 1584 1420 WerFault.exe 90 4672 1420 WerFault.exe 90 2100 1420 WerFault.exe 90 3768 1420 WerFault.exe 90 3664 1420 WerFault.exe 90 1624 1420 WerFault.exe 90 -
Kills process with taskkill 1 IoCs
pid Process 5060 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5060 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1420 wrote to memory of 776 1420 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 108 PID 1420 wrote to memory of 776 1420 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 108 PID 1420 wrote to memory of 776 1420 0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe 108 PID 776 wrote to memory of 5060 776 cmd.exe 112 PID 776 wrote to memory of 5060 776 cmd.exe 112 PID 776 wrote to memory of 5060 776 cmd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 7402⤵
- Program crash
PID:4724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 7882⤵
- Program crash
PID:1584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 9282⤵
- Program crash
PID:4672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 9362⤵
- Program crash
PID:2100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 8042⤵
- Program crash
PID:3768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 9842⤵
- Program crash
PID:3664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0d0d6d2d6edb381091bc23ad11694d46_JaffaCakes118.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 10642⤵
- Program crash
PID:1624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1420 -ip 14201⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1420 -ip 14201⤵PID:2228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1420 -ip 14201⤵PID:5016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1420 -ip 14201⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1420 -ip 14201⤵PID:3940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1420 -ip 14201⤵PID:2484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1420 -ip 14201⤵PID:3484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:2012