Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 22:44
Static task
static1
Behavioral task
behavioral1
Sample
0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe
-
Size
881KB
-
MD5
0cc094b93ea3fe9dcf1897e41d8ef875
-
SHA1
26a40e556b826052196a2bcea93d1962ea1a6eaf
-
SHA256
811745e059225a9d2c1e3a283c2895589f36332a5e90c6cbe3425b841b3b024d
-
SHA512
c98f2a184be3d15a7dbb3c7d882d3a8848dfd6709e461457ba84170a7ceea558f6494ab73c397144091e1715add5623b611c48078576c44c44a509425898c091
-
SSDEEP
12288:Y94in3qGaNHEyC9/oR9gy5ZHK7zWQDLDhjiKznNWOoyw1rFYi/tOfeAD7GK:8Pp9AR95SlLDxn0ORw1xYSt7e7GK
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
Xloader payload 3 IoCs
resource yara_rule behavioral2/memory/1600-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1600-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4944-24-0x0000000000BD0000-0x0000000000BF9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4076 set thread context of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 1600 set thread context of 3432 1600 RegSvcs.exe 56 PID 4944 set thread context of 3432 4944 wlanext.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 1600 RegSvcs.exe 1600 RegSvcs.exe 1600 RegSvcs.exe 1600 RegSvcs.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe 4944 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1600 RegSvcs.exe 1600 RegSvcs.exe 1600 RegSvcs.exe 4944 wlanext.exe 4944 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe Token: SeDebugPrivilege 1600 RegSvcs.exe Token: SeDebugPrivilege 4944 wlanext.exe Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4076 wrote to memory of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 4076 wrote to memory of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 4076 wrote to memory of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 4076 wrote to memory of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 4076 wrote to memory of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 4076 wrote to memory of 1600 4076 0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe 99 PID 3432 wrote to memory of 4944 3432 Explorer.EXE 100 PID 3432 wrote to memory of 4944 3432 Explorer.EXE 100 PID 3432 wrote to memory of 4944 3432 Explorer.EXE 100 PID 4944 wrote to memory of 4252 4944 wlanext.exe 101 PID 4944 wrote to memory of 4252 4944 wlanext.exe 101 PID 4944 wrote to memory of 4252 4944 wlanext.exe 101
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0cc094b93ea3fe9dcf1897e41d8ef875_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4252
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4308,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:81⤵PID:2592