Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 14:43
Static task
static1
Behavioral task
behavioral1
Sample
220fde8794275a553099945c5a1e929a_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
220fde8794275a553099945c5a1e929a_JaffaCakes118.exe
-
Size
853KB
-
MD5
220fde8794275a553099945c5a1e929a
-
SHA1
e1d3cd57e2aaeda5f04ca08396220127d216658f
-
SHA256
9e80f216016104cd0ccc58cb839a2fb6b62552806986ccd381eece1750ef3b3a
-
SHA512
dc2190c9044390f81be868ccd2611ceadd74d04dfef6ba6b1ce3b7dc4547dd4e693ece6b0d5b23000711e9de0c05012bd2f7a88c5fcea15436f29fb37e3bab77
-
SSDEEP
12288:JKr/HK7zXyaANxjyOTCA+WwN+Z8l/Fw706cgVv4kjqHgbn/SylVkicc4gmm4wXYc:JfTlAL3CPWw9/a7t7UATkicRW
Malware Config
Extracted
formbook
4.1
mxwf
orders-cialis.info
auctionorbuy.com
meanmugsamore.com
yachtcrewmark.com
sacredkashilifestudio.net
themintyard.com
bragafoods.com
sierp.com
hausofdeme.com
anthonyjames915.com
bajardepesoencasa.com
marciaroyal.com
earringlifter.com
dsdjfhd9ddksa1as.info
bmzproekt.com
employmentbc.com
ptsdtreatment.space
vrchance.com
cnrongding.com
welovelit.com
intercourierdelivery.services
ianwhitewrite.com
afcerd.com
beneficiodemedicare.com
gatel3ess.com
salesnksportswt.top
thewellnessloft365.com
totensa.com
jessicatheisen.com
snowtographers.com
executrainpr.com
puttypaw.com
popcorntimeipad.com
heyconi.com
llanoresources.com
ibusinesshero.com
1euro1ad.com
sparkleeapp.com
zhuxiugyh.com
calvinmaphoto.com
bjmaomao.com
isaacfujiki.com
zipwhipper.com
kontrollstutzen.com
hannaheason.media
zgcbw.net
letteringdagabi.com
kitefabrics.com
andherieastoffices.com
thewellnesstravelcompany.info
ohio.works
beacharita.com
alphamillls.com
sassandvinegar.com
usauber.com
ceylonherbslk.com
richardggreenhill.com
groupdae.com
jupiterccc.com
indoovo.com
sunnytheodora.com
gxpgfz.com
shoppandaxpress.com
heiboard.com
zahnimplantatangebotede.com
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2676-14-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/2676-17-0x0000000000860000-0x0000000000B63000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3004 set thread context of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2676 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31 PID 3004 wrote to memory of 2676 3004 220fde8794275a553099945c5a1e929a_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\220fde8794275a553099945c5a1e929a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\220fde8794275a553099945c5a1e929a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\220fde8794275a553099945c5a1e929a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\220fde8794275a553099945c5a1e929a_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676
-