Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 11:14
Static task
static1
Behavioral task
behavioral1
Sample
7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe
-
Size
338KB
-
MD5
7ef9fc6490d54da33055614b608cbf2e
-
SHA1
2b4c1379e1fdd86cf94e588ec98e0a8c7207a064
-
SHA256
096bfa3e2f4fed058fb0e59c58cdeb20e2e19fa321f77bfcdf1215160afdd753
-
SHA512
f6fb6da9996310c2f5ba08fd9f7023c13e88b21b0d4b8a8ce19716e63240982f0e23b61f5c426a4ae224734a6f49ebca3fe4e859504c130d7dc68a838db1bf77
-
SSDEEP
6144:pvg9I9HtsWVrwzq3tgtBkOZ45t1RRBZx:pvg9I966rwgP9
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral1/memory/2112-2-0x0000000000220000-0x0000000000268000-memory.dmp family_onlylogger behavioral1/memory/2112-3-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral1/memory/2112-6-0x0000000000400000-0x000000000044B000-memory.dmp family_onlylogger behavioral1/memory/2112-5-0x0000000000220000-0x0000000000268000-memory.dmp family_onlylogger behavioral1/memory/2112-4-0x0000000000400000-0x0000000000885000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 2544 cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 3016 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3016 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2544 2112 7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2544 2112 7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2544 2112 7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe 31 PID 2112 wrote to memory of 2544 2112 7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe 31 PID 2544 wrote to memory of 3016 2544 cmd.exe 33 PID 2544 wrote to memory of 3016 2544 cmd.exe 33 PID 2544 wrote to memory of 3016 2544 cmd.exe 33 PID 2544 wrote to memory of 3016 2544 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe" & exit2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "7ef9fc6490d54da33055614b608cbf2e_JaffaCakes118.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-