Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
98bc80b02b6ecf624e725404fc1841a1_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
98bc80b02b6ecf624e725404fc1841a1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
98bc80b02b6ecf624e725404fc1841a1_JaffaCakes118.exe
-
Size
286KB
-
MD5
98bc80b02b6ecf624e725404fc1841a1
-
SHA1
7a60ed9be96c5a70f5171b2873454bf9d0e2c05f
-
SHA256
454b57e15fb974a87afa3fcda4640319fb5fd568daf6c90d5161a820b5d3bdbb
-
SHA512
51194423f7fd82441301e8a8a028951ae8cbb4a32cf2824f7c746b6857a42db89f007fb4adeafa5163f0a6a3eab168d3709845268967abbbd4bdeced66108a3b
-
SSDEEP
6144:OT22Fj/TyCpr1pzcEytC5dyP1cOGJV2b:OT22FjOCpANKd7j2b
Malware Config
Extracted
gcleaner
gcl-page.biz
194.145.227.161
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 5 IoCs
resource yara_rule behavioral2/memory/4000-2-0x0000000000E30000-0x0000000000E5F000-memory.dmp family_onlylogger behavioral2/memory/4000-3-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/4000-5-0x0000000000E30000-0x0000000000E5F000-memory.dmp family_onlylogger behavioral2/memory/4000-7-0x0000000000400000-0x0000000000431000-memory.dmp family_onlylogger behavioral2/memory/4000-6-0x0000000000400000-0x0000000000877000-memory.dmp family_onlylogger -
Program crash 8 IoCs
pid pid_target Process procid_target 4804 4000 WerFault.exe 82 1224 4000 WerFault.exe 82 1360 4000 WerFault.exe 82 832 4000 WerFault.exe 82 1156 4000 WerFault.exe 82 1648 4000 WerFault.exe 82 5088 4000 WerFault.exe 82 1048 4000 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98bc80b02b6ecf624e725404fc1841a1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98bc80b02b6ecf624e725404fc1841a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\98bc80b02b6ecf624e725404fc1841a1_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 6202⤵
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 6562⤵
- Program crash
PID:1224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 7442⤵
- Program crash
PID:1360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 7442⤵
- Program crash
PID:832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 5322⤵
- Program crash
PID:1156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 10202⤵
- Program crash
PID:1648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 10282⤵
- Program crash
PID:5088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 10762⤵
- Program crash
PID:1048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4000 -ip 40001⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4000 -ip 40001⤵PID:412
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4000 -ip 40001⤵PID:2872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4000 -ip 40001⤵PID:4120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4000 -ip 40001⤵PID:4976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4000 -ip 40001⤵PID:1072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4000 -ip 40001⤵PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4000 -ip 40001⤵PID:372