Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2024, 05:25

General

  • Target

    5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe

  • Size

    379KB

  • MD5

    5b0a7253de15bf159141d624fea88528

  • SHA1

    e9f9c12864ed0c7360bbe94760e5d1172e66d17d

  • SHA256

    fcfe0e26e945ba5fbde5d01cad9bcb66b2c9623bc8cdc627e9c886e32fde6134

  • SHA512

    677cd314a3c0b3b9e404d73b249ca4f507c5a55c4d005581f3662680757fe7aee723e13d74bcaac07f6a8dd02b91a0226100880732a9ab38a71395f693c4653f

  • SSDEEP

    6144:EMoDVV7WRRKZ/tDTuHHV2Y/IGwNLcW6g/AE/rPz9+X:gr7W3KDDTyV2yInJPz

Malware Config

Extracted

Family

gcleaner

C2

gc-prtnrs.top

gcc-prtnrs.top

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger payload 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 624
      2⤵
      • Program crash
      PID:4428
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 640
      2⤵
      • Program crash
      PID:4644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 748
      2⤵
      • Program crash
      PID:4680
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 764
      2⤵
      • Program crash
      PID:4440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 736
      2⤵
      • Program crash
      PID:1608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1092
      2⤵
      • Program crash
      PID:2648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1136
      2⤵
      • Program crash
      PID:3736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1552
      2⤵
      • Program crash
      PID:4248
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\51647310515.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2816
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\94506954688.exe" /mix
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4220
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\72644625794.exe" /mix
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1924
      2⤵
      • Program crash
      PID:4324
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe" & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "5b0a7253de15bf159141d624fea88528_JaffaCakes118.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3636
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1932
      2⤵
      • Program crash
      PID:4060
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 788 -ip 788
    1⤵
      PID:4704
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 788 -ip 788
      1⤵
        PID:692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 788 -ip 788
        1⤵
          PID:5012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 788 -ip 788
          1⤵
            PID:5028
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 788 -ip 788
            1⤵
              PID:4836
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 788 -ip 788
              1⤵
                PID:4196
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 788 -ip 788
                1⤵
                  PID:1824
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 788 -ip 788
                  1⤵
                    PID:2564
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 788 -ip 788
                    1⤵
                      PID:4624
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 788 -ip 788
                      1⤵
                        PID:3988

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\{bU9l-QnOgu-0KWR-cPsat}\51647310515.exe

                        Filesize

                        162B

                        MD5

                        1b7c22a214949975556626d7217e9a39

                        SHA1

                        d01c97e2944166ed23e47e4a62ff471ab8fa031f

                        SHA256

                        340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                        SHA512

                        ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                      • memory/788-1-0x00000000032C0000-0x00000000033C0000-memory.dmp

                        Filesize

                        1024KB

                      • memory/788-2-0x0000000004FA0000-0x0000000004FCE000-memory.dmp

                        Filesize

                        184KB

                      • memory/788-3-0x0000000000400000-0x0000000000431000-memory.dmp

                        Filesize

                        196KB

                      • memory/788-12-0x0000000000400000-0x0000000000431000-memory.dmp

                        Filesize

                        196KB

                      • memory/788-11-0x0000000004FA0000-0x0000000004FCE000-memory.dmp

                        Filesize

                        184KB

                      • memory/788-10-0x0000000000400000-0x000000000325A000-memory.dmp

                        Filesize

                        46.4MB