Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe
-
Size
386KB
-
MD5
b5b72dd8278704a788474db8f2f49ded
-
SHA1
86e29037f5340e11c4ccd82f87ba63078478f8fe
-
SHA256
9bae7ac9a2137a2ee80c91bdec7cf9e475a2c9e7822b1a2c63a63516cf00733d
-
SHA512
cde580116165fa59ff82e979c09588af16984896b85c225c19cf2c58212f0e8c498918b9ed71954f3d84b6163fd7f0513bbe5dd28463aac906946aac6830bfcf
-
SSDEEP
12288:TtJluZ+meKuRmj6E+hlYLyCRTG99vOKUol:jUQkEPYL1W5Oe
Malware Config
Extracted
gcleaner
gcleaner.pro
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 7 IoCs
resource yara_rule behavioral1/memory/1964-2-0x0000000000220000-0x000000000026C000-memory.dmp family_onlylogger behavioral1/memory/1964-3-0x0000000000400000-0x000000000044F000-memory.dmp family_onlylogger behavioral1/memory/1964-6-0x0000000000220000-0x000000000026C000-memory.dmp family_onlylogger behavioral1/memory/1964-5-0x0000000000400000-0x0000000002BD6000-memory.dmp family_onlylogger behavioral1/memory/1964-9-0x0000000000400000-0x000000000044F000-memory.dmp family_onlylogger behavioral1/memory/1964-8-0x0000000000400000-0x000000000044F000-memory.dmp family_onlylogger behavioral1/memory/1964-7-0x0000000000400000-0x0000000002BD6000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 2292 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 2720 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2720 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2292 1964 b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe 31 PID 1964 wrote to memory of 2292 1964 b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe 31 PID 1964 wrote to memory of 2292 1964 b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe 31 PID 1964 wrote to memory of 2292 1964 b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe 31 PID 2292 wrote to memory of 2720 2292 cmd.exe 33 PID 2292 wrote to memory of 2720 2292 cmd.exe 33 PID 2292 wrote to memory of 2720 2292 cmd.exe 33 PID 2292 wrote to memory of 2720 2292 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe" & exit2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "b5b72dd8278704a788474db8f2f49ded_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-