Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2024, 19:36

General

  • Target

    36797ec026ef56a9ec2be58f804a11af_JaffaCakes118.exe

  • Size

    850KB

  • MD5

    36797ec026ef56a9ec2be58f804a11af

  • SHA1

    a6e03ddc21b97c6ef50ee69ec95b008fbda67e4d

  • SHA256

    ffb4062f3105628be393872c098765b9a7736911cb8fee4ff571b006a891c8a8

  • SHA512

    d4a3aad5560b683fc05b4ec48399bf6412e233bcece7396377f0684b206f5818b918c3fd73bf108371b361d1361882a1a7fdcd40fea0104de06f94c43a1764f4

  • SSDEEP

    24576:iDZPpbcn+nTZkINpPTE0v1HVp6CHJnhM0:4xtcnc9hfv1HGs+0

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

m6b5

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\36797ec026ef56a9ec2be58f804a11af_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\36797ec026ef56a9ec2be58f804a11af_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2280
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3012
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:496
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:1264
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:1608
            • C:\Windows\SysWOW64\autoconv.exe
              "C:\Windows\SysWOW64\autoconv.exe"
              2⤵
                PID:2172
              • C:\Windows\SysWOW64\autoconv.exe
                "C:\Windows\SysWOW64\autoconv.exe"
                2⤵
                  PID:2220
                • C:\Windows\SysWOW64\autoconv.exe
                  "C:\Windows\SysWOW64\autoconv.exe"
                  2⤵
                    PID:2360
                  • C:\Windows\SysWOW64\autoconv.exe
                    "C:\Windows\SysWOW64\autoconv.exe"
                    2⤵
                      PID:2112
                    • C:\Windows\SysWOW64\autoconv.exe
                      "C:\Windows\SysWOW64\autoconv.exe"
                      2⤵
                        PID:2064
                      • C:\Windows\SysWOW64\autoconv.exe
                        "C:\Windows\SysWOW64\autoconv.exe"
                        2⤵
                          PID:2240
                        • C:\Windows\SysWOW64\autoconv.exe
                          "C:\Windows\SysWOW64\autoconv.exe"
                          2⤵
                            PID:1724
                          • C:\Windows\SysWOW64\autoconv.exe
                            "C:\Windows\SysWOW64\autoconv.exe"
                            2⤵
                              PID:2248
                            • C:\Windows\SysWOW64\autoconv.exe
                              "C:\Windows\SysWOW64\autoconv.exe"
                              2⤵
                                PID:2556
                              • C:\Windows\SysWOW64\autoconv.exe
                                "C:\Windows\SysWOW64\autoconv.exe"
                                2⤵
                                  PID:2212
                                • C:\Windows\SysWOW64\autoconv.exe
                                  "C:\Windows\SysWOW64\autoconv.exe"
                                  2⤵
                                    PID:2148
                                  • C:\Windows\SysWOW64\autoconv.exe
                                    "C:\Windows\SysWOW64\autoconv.exe"
                                    2⤵
                                      PID:1744
                                    • C:\Windows\SysWOW64\autoconv.exe
                                      "C:\Windows\SysWOW64\autoconv.exe"
                                      2⤵
                                        PID:2068
                                      • C:\Windows\SysWOW64\autoconv.exe
                                        "C:\Windows\SysWOW64\autoconv.exe"
                                        2⤵
                                          PID:2408
                                        • C:\Windows\SysWOW64\autoconv.exe
                                          "C:\Windows\SysWOW64\autoconv.exe"
                                          2⤵
                                            PID:3036
                                          • C:\Windows\SysWOW64\autoconv.exe
                                            "C:\Windows\SysWOW64\autoconv.exe"
                                            2⤵
                                              PID:2288
                                            • C:\Windows\SysWOW64\autoconv.exe
                                              "C:\Windows\SysWOW64\autoconv.exe"
                                              2⤵
                                                PID:3024
                                              • C:\Windows\SysWOW64\autoconv.exe
                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                2⤵
                                                  PID:2332
                                                • C:\Windows\SysWOW64\autoconv.exe
                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                  2⤵
                                                    PID:1864
                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                    2⤵
                                                      PID:1924
                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                      2⤵
                                                        PID:1928
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        "C:\Windows\SysWOW64\netsh.exe"
                                                        2⤵
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: MapViewOfSection
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1632
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1716

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • memory/1192-25-0x00000000046C0000-0x000000000482C000-memory.dmp

                                                      Filesize

                                                      1.4MB

                                                    • memory/1192-21-0x00000000046C0000-0x000000000482C000-memory.dmp

                                                      Filesize

                                                      1.4MB

                                                    • memory/1632-22-0x0000000000A10000-0x0000000000A2B000-memory.dmp

                                                      Filesize

                                                      108KB

                                                    • memory/1632-23-0x0000000000A10000-0x0000000000A2B000-memory.dmp

                                                      Filesize

                                                      108KB

                                                    • memory/1632-24-0x0000000000080000-0x00000000000A9000-memory.dmp

                                                      Filesize

                                                      164KB

                                                    • memory/2700-3-0x0000000000500000-0x0000000000516000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/2700-6-0x0000000005390000-0x000000000542E000-memory.dmp

                                                      Filesize

                                                      632KB

                                                    • memory/2700-7-0x0000000004420000-0x000000000444E000-memory.dmp

                                                      Filesize

                                                      184KB

                                                    • memory/2700-5-0x0000000074410000-0x0000000074AFE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/2700-4-0x000000007441E000-0x000000007441F000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2700-0-0x000000007441E000-0x000000007441F000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2700-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/2700-15-0x0000000074410000-0x0000000074AFE000-memory.dmp

                                                      Filesize

                                                      6.9MB

                                                    • memory/2700-1-0x0000000000E80000-0x0000000000F5A000-memory.dmp

                                                      Filesize

                                                      872KB

                                                    • memory/3012-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/3012-19-0x0000000000400000-0x0000000000429000-memory.dmp

                                                      Filesize

                                                      164KB

                                                    • memory/3012-20-0x00000000001D0000-0x00000000001E0000-memory.dmp

                                                      Filesize

                                                      64KB

                                                    • memory/3012-16-0x0000000000A40000-0x0000000000D43000-memory.dmp

                                                      Filesize

                                                      3.0MB

                                                    • memory/3012-10-0x0000000000400000-0x0000000000429000-memory.dmp

                                                      Filesize

                                                      164KB

                                                    • memory/3012-14-0x0000000000400000-0x0000000000429000-memory.dmp

                                                      Filesize

                                                      164KB

                                                    • memory/3012-8-0x0000000000400000-0x0000000000429000-memory.dmp

                                                      Filesize

                                                      164KB