Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2024, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe
-
Size
740KB
-
MD5
aa71f2483d9c2e808cd3e3e56c2b463f
-
SHA1
cd41370a62b7cab949c04fdcd6578438c410e7c2
-
SHA256
1ad6352350f0b871f3757d1994aa42fee726cdca78834f743f09e8a15bfc3dd1
-
SHA512
72d93357b75b7451719c4580fadd00a8885813b8b236fa1e3c4ea2692d516f1ba98f7b320256bf12fd7c5dc02240fe850552694f3aac36cd3facc9bbbb54d2f2
-
SSDEEP
12288:sqnBhp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXck4xeLbf:sqnkCeLWgLX2UxEYTMcDz+BJmdcHlsIE
Malware Config
Extracted
xloader
2.3
uecu
ishtarhotel.com
woodstrends.icu
jalenowens.com
manno.expert
ssg1asia.com
telepathylaw.com
quickoprintnv.com
abrosnm3.com
lumberjackcatering.com
beachujamaica.com
thomasjeffersonbyrd.com
starryfinds.com
shelavish2.com
royalglamempirellc.com
deixandomeuemprego.com
alexgoestech.xyz
opticamn.com
fermanchevybrandon.com
milbodegas.info
adunarsrl.com
dataatlus.com
missabrams.com
beaconservicesuk.com
tvforpc.website
dipmarketingagency.com
milsontt.com
londonsashwindowsservices.com
feedmysheepdaily.com
firsttimephysics.com
hosefire.com
southdocknj.com
idfstool.com
drelip.com
decayette.com
awakenedgodsofbeauty.com
easttexasranch.com
risinglanka.com
meetingoffices.com
vase-composition.com
kupon.asia
alltimeselfstorage.com
gatorbrewcoffee.com
api-pay-agent.com
height-project.online
flbtyc638.com
psdmoravita.com
highbrowhairstudio.com
deepblueriver.com
yh22022.com
sts-100.com
michaelfmoore.com
alzheimers.computer
produtos-servicos.website
zyuyktlcu.icu
ezewasser.com
outstanding-palisade.com
saioura.com
core.run
allaboutlifeblog.com
foodolog.net
somerderm.com
scootrlv.com
ahjjbxg.com
gasworldchampionships.com
illoftapartments.com
Signatures
-
Xloader family
-
Xloader payload 3 IoCs
resource yara_rule behavioral2/memory/4556-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/4556-17-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2344-22-0x00000000006F0000-0x0000000000718000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4600 set thread context of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 4556 set thread context of 3392 4556 RegSvcs.exe 56 PID 2344 set thread context of 3392 2344 ipconfig.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2344 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 4556 RegSvcs.exe 4556 RegSvcs.exe 4556 RegSvcs.exe 4556 RegSvcs.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe 2344 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4556 RegSvcs.exe 4556 RegSvcs.exe 4556 RegSvcs.exe 2344 ipconfig.exe 2344 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe Token: SeDebugPrivilege 4556 RegSvcs.exe Token: SeDebugPrivilege 2344 ipconfig.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 4600 wrote to memory of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 4600 wrote to memory of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 4600 wrote to memory of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 4600 wrote to memory of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 4600 wrote to memory of 4556 4600 aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe 91 PID 3392 wrote to memory of 2344 3392 Explorer.EXE 92 PID 3392 wrote to memory of 2344 3392 Explorer.EXE 92 PID 3392 wrote to memory of 2344 3392 Explorer.EXE 92 PID 2344 wrote to memory of 1732 2344 ipconfig.exe 93 PID 2344 wrote to memory of 1732 2344 ipconfig.exe 93 PID 2344 wrote to memory of 1732 2344 ipconfig.exe 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aa71f2483d9c2e808cd3e3e56c2b463f_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1732
-
-