Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/10/2024, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
5c5a4fd610f0280cdd7974f05f6e9dbd
-
SHA1
ab1bb4fe48edf3de26ad23ff8e8c7337670e722e
-
SHA256
0ac18a14f9f6bc187d707c10800aca93298b7ca07bdf43994875ff8d93f6d01b
-
SHA512
48b26477cba2ec2115be77d7f962078a3d88e1b65a2b6fbdb2f670092b0a1561f5073e883d5bfb56aa8168838ebc238c6a12e449005075c77f5d382ab4b6b7a1
-
SSDEEP
24576:tsjYgPyn9C/uG4M7yjU4++UQwgzT2fXdvOm:izK9nGb7yjQZgzT2/
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
Xloader payload 3 IoCs
resource yara_rule behavioral1/memory/1152-14-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1152-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2624-23-0x0000000000220000-0x0000000000249000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2424 set thread context of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 1152 set thread context of 1232 1152 RegSvcs.exe 21 PID 2624 set thread context of 1232 2624 mstsc.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1152 RegSvcs.exe 1152 RegSvcs.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe 2624 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1152 RegSvcs.exe 1152 RegSvcs.exe 1152 RegSvcs.exe 2624 mstsc.exe 2624 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1152 RegSvcs.exe Token: SeDebugPrivilege 2624 mstsc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 2424 wrote to memory of 1152 2424 5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe 30 PID 1232 wrote to memory of 2624 1232 Explorer.EXE 31 PID 1232 wrote to memory of 2624 1232 Explorer.EXE 31 PID 1232 wrote to memory of 2624 1232 Explorer.EXE 31 PID 1232 wrote to memory of 2624 1232 Explorer.EXE 31 PID 2624 wrote to memory of 1732 2624 mstsc.exe 32 PID 2624 wrote to memory of 1732 2624 mstsc.exe 32 PID 2624 wrote to memory of 1732 2624 mstsc.exe 32 PID 2624 wrote to memory of 1732 2624 mstsc.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c5a4fd610f0280cdd7974f05f6e9dbd_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1732
-
-