Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe
-
Size
337KB
-
MD5
055e3d97992efa668f7cd92ee301ebf4
-
SHA1
326fb8c7e9fecb54570fdd9e3ee3165ca68658c9
-
SHA256
090e8bd14dcd133d966ef11bf9ac340e9c55835d9a70c77a211cd15e8540a9a4
-
SHA512
b8dc8317d049b4e3290badd6081c0bcadbd6c4a5af232395c96f92933c58da3de90cb846a7c1c707d7f306c547bb658871cfe3c73122ecea91ecb96d185710f8
-
SSDEEP
6144:8NN9wy0tamsE/6suyzgdygi/T0Yr6cfee3cf/zC:8bOXtamUsuyzGpib0oLfe8c3z
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/3532-2-0x0000000000890000-0x00000000008D8000-memory.dmp family_onlylogger behavioral2/memory/3532-3-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral2/memory/3532-5-0x0000000000890000-0x00000000008D8000-memory.dmp family_onlylogger behavioral2/memory/3532-6-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral2/memory/3532-4-0x0000000000400000-0x0000000000884000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
pid pid_target Process procid_target 1316 3532 WerFault.exe 88 1884 3532 WerFault.exe 88 4820 3532 WerFault.exe 88 1928 3532 WerFault.exe 88 3040 3532 WerFault.exe 88 4584 3532 WerFault.exe 88 4948 3532 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 4728 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4728 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3532 wrote to memory of 3832 3532 055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe 106 PID 3532 wrote to memory of 3832 3532 055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe 106 PID 3532 wrote to memory of 3832 3532 055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe 106 PID 3832 wrote to memory of 4728 3832 cmd.exe 110 PID 3832 wrote to memory of 4728 3832 cmd.exe 110 PID 3832 wrote to memory of 4728 3832 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 7242⤵
- Program crash
PID:1316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 7842⤵
- Program crash
PID:1884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 9202⤵
- Program crash
PID:4820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 9322⤵
- Program crash
PID:1928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 9242⤵
- Program crash
PID:3040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 9682⤵
- Program crash
PID:4584
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "055e3d97992efa668f7cd92ee301ebf4_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 11122⤵
- Program crash
PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3532 -ip 35321⤵PID:396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3532 -ip 35321⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3532 -ip 35321⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3532 -ip 35321⤵PID:2980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3532 -ip 35321⤵PID:2664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3532 -ip 35321⤵PID:1016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3532 -ip 35321⤵PID:2340
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2540,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:81⤵PID:2420