Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2024, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe
-
Size
379KB
-
MD5
5b0a7253de15bf159141d624fea88528
-
SHA1
e9f9c12864ed0c7360bbe94760e5d1172e66d17d
-
SHA256
fcfe0e26e945ba5fbde5d01cad9bcb66b2c9623bc8cdc627e9c886e32fde6134
-
SHA512
677cd314a3c0b3b9e404d73b249ca4f507c5a55c4d005581f3662680757fe7aee723e13d74bcaac07f6a8dd02b91a0226100880732a9ab38a71395f693c4653f
-
SSDEEP
6144:EMoDVV7WRRKZ/tDTuHHV2Y/IGwNLcW6g/AE/rPz9+X:gr7W3KDDTyV2yInJPz
Malware Config
Extracted
gcleaner
gc-prtnrs.top
gcc-prtnrs.top
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/788-2-0x0000000004FA0000-0x0000000004FCE000-memory.dmp family_onlylogger behavioral2/memory/788-3-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/788-12-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/788-11-0x0000000004FA0000-0x0000000004FCE000-memory.dmp family_onlylogger behavioral2/memory/788-10-0x0000000000400000-0x000000000325A000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 30 iplogger.org 32 iplogger.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
pid pid_target Process procid_target 4428 788 WerFault.exe 83 4644 788 WerFault.exe 83 4680 788 WerFault.exe 83 4440 788 WerFault.exe 83 1608 788 WerFault.exe 83 2648 788 WerFault.exe 83 3736 788 WerFault.exe 83 4248 788 WerFault.exe 83 4324 788 WerFault.exe 83 4060 788 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 3636 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3636 taskkill.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 788 wrote to memory of 2816 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 110 PID 788 wrote to memory of 2816 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 110 PID 788 wrote to memory of 2816 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 110 PID 788 wrote to memory of 4220 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 112 PID 788 wrote to memory of 4220 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 112 PID 788 wrote to memory of 4220 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 112 PID 788 wrote to memory of 4420 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 114 PID 788 wrote to memory of 4420 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 114 PID 788 wrote to memory of 4420 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 114 PID 788 wrote to memory of 3648 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 118 PID 788 wrote to memory of 3648 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 118 PID 788 wrote to memory of 3648 788 5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe 118 PID 3648 wrote to memory of 3636 3648 cmd.exe 122 PID 3648 wrote to memory of 3636 3648 cmd.exe 122 PID 3648 wrote to memory of 3636 3648 cmd.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 6242⤵
- Program crash
PID:4428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 6402⤵
- Program crash
PID:4644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 7482⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 7642⤵
- Program crash
PID:4440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 7362⤵
- Program crash
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 10922⤵
- Program crash
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 11362⤵
- Program crash
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 15522⤵
- Program crash
PID:4248
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\51647310515.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\94506954688.exe" /mix2⤵
- System Location Discovery: System Language Discovery
PID:4220
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\72644625794.exe" /mix2⤵
- System Location Discovery: System Language Discovery
PID:4420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 19242⤵
- Program crash
PID:4324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 19322⤵
- Program crash
PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 788 -ip 7881⤵PID:4704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 788 -ip 7881⤵PID:692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 788 -ip 7881⤵PID:5012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 788 -ip 7881⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 788 -ip 7881⤵PID:4836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 788 -ip 7881⤵PID:4196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 788 -ip 7881⤵PID:1824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 788 -ip 7881⤵PID:2564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 788 -ip 7881⤵PID:4624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 788 -ip 7881⤵PID:3988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5