Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe
-
Size
252KB
-
MD5
8e6e835dede4156784b26cb01339f050
-
SHA1
d0f3846526cf7ed69b67301e419f72ce8ba981fd
-
SHA256
8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762
-
SHA512
05a4bda590b1d147aeb2a32b5c0c758700c585502083c003295b4ebe46927455e646b67b3570c11981441c3f90fb89e1441b72b7192755c8b8fa3efb50979516
-
SSDEEP
6144:pIYAQk0weX2qSCpwv3+Ag/DomARu+Vd9Unv:CY3k2X2qJpC3PoX+VP
Malware Config
Extracted
gcleaner
gcc-partners.in
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/3112-2-0x00000000009A0000-0x00000000009EC000-memory.dmp family_onlylogger behavioral2/memory/3112-3-0x0000000000400000-0x000000000044F000-memory.dmp family_onlylogger behavioral2/memory/3112-4-0x0000000000400000-0x00000000004EA000-memory.dmp family_onlylogger behavioral2/memory/3112-6-0x0000000000400000-0x000000000044F000-memory.dmp family_onlylogger behavioral2/memory/3112-5-0x00000000009A0000-0x00000000009EC000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
pid pid_target Process procid_target 3484 3112 WerFault.exe 83 3700 3112 WerFault.exe 83 1720 3112 WerFault.exe 83 4976 3112 WerFault.exe 83 3460 3112 WerFault.exe 83 116 3112 WerFault.exe 83 2580 3112 WerFault.exe 83 4968 3112 WerFault.exe 83 1616 3112 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 2024 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2024 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3112 wrote to memory of 772 3112 8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe 109 PID 3112 wrote to memory of 772 3112 8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe 109 PID 3112 wrote to memory of 772 3112 8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe 109 PID 772 wrote to memory of 2024 772 cmd.exe 113 PID 772 wrote to memory of 2024 772 cmd.exe 113 PID 772 wrote to memory of 2024 772 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 6122⤵
- Program crash
PID:3484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 6322⤵
- Program crash
PID:3700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 7402⤵
- Program crash
PID:1720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 7602⤵
- Program crash
PID:4976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 7762⤵
- Program crash
PID:3460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 10882⤵
- Program crash
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 11922⤵
- Program crash
PID:2580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 12242⤵
- Program crash
PID:4968
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "8e6e835dede4156784b26cb01339f050_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 12682⤵
- Program crash
PID:1616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3112 -ip 31121⤵PID:4056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3112 -ip 31121⤵PID:3716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3112 -ip 31121⤵PID:1292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3112 -ip 31121⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3112 -ip 31121⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3112 -ip 31121⤵PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3112 -ip 31121⤵PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3112 -ip 31121⤵PID:1352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3112 -ip 31121⤵PID:1544