Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe
-
Size
1006KB
-
MD5
1fd9cebb62fdfd2ee9533e35a6d14aa3
-
SHA1
d43f787cf9f8c5588f6c267d3983ca5ecf6acc88
-
SHA256
c85eab78147f680f396925b005564604d84bcff97fec4bfb27e13071e791d985
-
SHA512
cc965a63a729e0be816c646155ebf201464b6d40362c9eccdab53a3653c361c829069b354f9e38dd24ac2b89ec52c7f733b825e74d45c34ec8b5588065888088
-
SSDEEP
12288:oErs4ma/bma0cxKGU2fBCRKzPARKhpwAyxRD7U4qZ2vEVBhUSB:o3XaiC/ZCAjAcwAADTqZ2vEVBhU
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/2720-14-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2720-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2720-23-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1944-29-0x00000000000A0000-0x00000000000C9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3048 set thread context of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 2720 set thread context of 1200 2720 RegSvcs.exe 21 PID 2720 set thread context of 1200 2720 RegSvcs.exe 21 PID 1944 set thread context of 1200 1944 colorcpl.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 2720 RegSvcs.exe 2720 RegSvcs.exe 2720 RegSvcs.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe 1944 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2720 RegSvcs.exe 2720 RegSvcs.exe 2720 RegSvcs.exe 2720 RegSvcs.exe 1944 colorcpl.exe 1944 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe Token: SeDebugPrivilege 2720 RegSvcs.exe Token: SeDebugPrivilege 1944 colorcpl.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 3048 wrote to memory of 2720 3048 1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe 30 PID 1200 wrote to memory of 1944 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1944 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1944 1200 Explorer.EXE 31 PID 1200 wrote to memory of 1944 1200 Explorer.EXE 31 PID 1944 wrote to memory of 2612 1944 colorcpl.exe 32 PID 1944 wrote to memory of 2612 1944 colorcpl.exe 32 PID 1944 wrote to memory of 2612 1944 colorcpl.exe 32 PID 1944 wrote to memory of 2612 1944 colorcpl.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1fd9cebb62fdfd2ee9533e35a6d14aa3_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2612
-
-