Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
e9hp4zrhw.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
e9hp4zrhw.dll
Resource
win10v2004-20240802-en
General
-
Target
c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe
-
Size
227KB
-
MD5
c23cd3266f9085ba12e269d4ddc79fc2
-
SHA1
ac9fd1bfddfd284f337401c8e8ebb3c2f383888e
-
SHA256
cfc09cd2a2109a174ccbc346779f2e19316be4601173e2e85c3e4314cc139017
-
SHA512
b616107756ac12316491bf13eeb4815ee35fcc30ff25617728825e05abf1c28482bcb95bad86e860b600ff1fec6ca3fd8390e21af16ac398a637436328dc7c99
-
SSDEEP
6144:ix/MjhXmaBmrBnzDKhWye8yLL3pgndztwH2X:GDaBmNX6W78yLTKnh
Malware Config
Extracted
xloader
2.3
cna8
exceptionalhospital.com
agshorizon.com
sabaisurfing.com
kathrynprosser.com
news-roma.com
lareinadelosalisados.com
iregretnotcomingupwithit.com
dreamwrldrp.com
brickhallschool-ng.com
exgobal.com
ojcllc.com
pineviewsunrise.com
ru-joking.com
theparkplasticsurgery.com
mouthsecond.today
princessmasksandapparel.com
onlinedavetiyecim.com
animegirls.xyz
heicat.club
brazillianallstars.com
evlvacations.com
loveworldjerusalem.com
u9wm4u5fssmaj.net
diamondmobiledetailingmo.com
christlicheliebe.net
bemeximus.com
resellerpagecomputers.com
bexbakingcompany.com
trytagawy.com
consentidomusic.com
hauntedthing.com
taoranzz.com
saiparahnama.com
eiz.one
advokatpengacara.com
rapidocoin.net
okbabe.site
cursoexitus.com
zbjingrui.com
diy-and-home-improvementt.com
triaggdesign.com
theplushtoothbrush.com
cowbex.info
outhomenow.com
dietas-medicas.com
czpeixun.com
interlingue.info
18tshortstore.com
jubilee21.com
5725carnarvon.com
sussexnutritionist.com
flyonit.network
ouhaiwutian.com
thebombshellcomics.com
loc7v7.com
san-andreas.online
oilyusa.com
starsandspices.com
goldenpictureszambia.com
cozdat.site
hyderabadmanhattancondos.com
svsnovotec.com
larray.com
wesharefiles.com
oeayzom.com
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral1/memory/2584-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 2 IoCs
pid Process 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3008 set thread context of 2584 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 2584 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2584 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 30 PID 3008 wrote to memory of 2584 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 30 PID 3008 wrote to memory of 2584 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 30 PID 3008 wrote to memory of 2584 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 30 PID 3008 wrote to memory of 2584 3008 c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c23cd3266f9085ba12e269d4ddc79fc2_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5efb4c530d67cba244b62b495cf461da2
SHA108ba71eb66ffef70962311e862091aefb735e123
SHA2568a85f01867092494ad32e29b1cd117982deddea5b21d83dec5f1f8b9565a3cfc
SHA512c035248fb01243b1101c13b59859539e9362984572ce6cd6914b27066bb1acb338f1ff0e51d46266613cb36efbf4489b1d607ade6852f9883a17fde4383546e0
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c