Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240730-en
Behavioral task
behavioral5
Sample
f3o1dwv0.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
f3o1dwv0.dll
Resource
win10v2004-20240730-en
General
-
Target
82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe
-
Size
210KB
-
MD5
82ff84daa76328f4a969469cf54cb260
-
SHA1
9b9a82cf71a0c89be5bf8d4222466aae18fe96bb
-
SHA256
a4ed754c1a38fd8fc24bb4ec7f5da899c254df070bcc8cfd7b16778701c4b72d
-
SHA512
4d351afae00cf159ee7eecca5af6caed1fe1d5eb1f6159e5aa1da7a10dd47f60d19d8d0f16ffb8a0c99ecfe28a77979673ddee36002e5588c5f296860cf6e102
-
SSDEEP
6144:IqjIpb4mXqk3XGj1D0IP7TwXLNTyzAkMBnOUot:FG8Mqk3g1d7Mbcc9BVk
Malware Config
Extracted
xloader
2.3
ivay
b4ukid.com
missioncontrol2030.com
chriswhitefoto.com
guepard-marine.com
getlauded.com
jingdonglm.com
clintlove.com
boldstrategicmedia.com
bluebay3dwdmall.com
aishag.com
forexexpoaward.com
basslakedisposal.com
bukannyaterbuai36.com
learntrhc.com
cancunpolo.com
case-cornershop.com
tahiticomplementos.com
dashanzhf.com
wholeholistichealth.com
inass-yassin.com
citestiprb151at29.com
kazancsere.net
ittakesavillagekitchen.info
jkmibszou.icu
lindamaearmstrong.com
chaithanyaonline.com
blowdryingcontest.com
nail-junkie.com
wokinbarbecue.com
thefreemusic.net
digitaldynasti.com
unclonedstream.com
utensilgranchi.com
meszur.com
stevebucci.com
acresvisionent.com
knit1eat1.com
highendsmokeshop.com
pearyazilim.com
andcarryon.com
nailzcrafted.com
homekitchenid.com
pingds.info
connectionsitsolutions.com
tradesfortomorrow.com
roadofcherrytrees.com
roeromeccanica.com
rzpte.com
royaibanks.com
freshwaterflower.com
livr.chat
findandnews.com
cpnpproductions.com
jacknow123.com
kaywoodward.com
houseofvortex.com
goodfood.directory
bosolia.com
caragross.com
racevx.xyz
americanshieldhome.com
drexelflux.com
gxwl1688.com
hurrytrip.com
digitalneeds.tech
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral1/memory/2708-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 2 IoCs
pid Process 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2672 set thread context of 2708 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 2708 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2708 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2708 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2708 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2708 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2708 2672 82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\82ff84daa76328f4a969469cf54cb260_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD52459486e1baaf3a26804e33c80e2f5d3
SHA14803e967878de7371a1aeed9ad05627fd8f07aa8
SHA25665a2e26e02f003431245df8d0527f64efce3dad7fd85f169e5269576d14ee024
SHA51269a5b0fbf982005d3342420552828c43a0c58f0df5ca449f1a88da2c1a75550b28ce7a737ee919bc4bc52dfec5fa0a2e1c15c90360a264266e7ce18b02379966
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c