Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe
-
Size
128KB
-
MD5
fc772058f20a4fbab7709e30961fe514
-
SHA1
01bdaccc419eb73314bab4e48cad5e35317a0e29
-
SHA256
3ab530ce57aeada7df44a9f485db344f51c0e09465a543ef072bde794a446263
-
SHA512
4d7feb5b2f80eaf5d2f13945eec714526b9b9fc3a761d89909f6d91b6ad2a2c70483bf0f19c63d7b4a8aefef16bca42c60afd376bea54499b396caea981ccdf9
-
SSDEEP
3072:uGHi6mwjDl3q65eRX6BBZnF4ZohM+sJNH2MkHfbZjH:+QDs65m6BBjFhMFH2MkN
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://216.231.139.111/forum/viewtopic.php
-
payload_url
http://ctl-mexico.com/WtgME.exe
http://cvilleshootingstars.com/JzU.exe
http://ctamdq.org.ar/bigQm.exe
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3796 wrote to memory of 2428 3796 fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe 84 PID 3796 wrote to memory of 2428 3796 fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe 84 PID 3796 wrote to memory of 2428 3796 fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc772058f20a4fbab7709e30961fe514_JaffaCakes118.exe"2⤵PID:2428
-