Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 01:30

General

  • Target

    c54014c8c3d524d217670b262e5cfc4b_JaffaCakes118.exe

  • Size

    800KB

  • MD5

    c54014c8c3d524d217670b262e5cfc4b

  • SHA1

    6eedabbd4ea50a1881d3e3f9ecc869033e0ec9b3

  • SHA256

    fa7a3ac64a6c26f248d805abfb0961bfe6518df6dcb3212de51593b92d5e4158

  • SHA512

    7aea488816c8635e4958edc99c771817c460efea425e78e99bd5adbcd5871f6e76329dc1e19bac0d35ac0989c8e5fb07e07c4b214601b37e27e8c7ced264812b

  • SSDEEP

    24576:rQ9D7dL89uJD0Bl0BmcH69JAcvKnW7C0KHGoD4r:4dL89uJDnIPo

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ssee

Decoy

portalcanaa.com

korzino.com

dlylms.net

smartearphoneshop.com

olimiloshop.com

auvdigitalstack.com

ydxc.chat

yhk868.com

lifeinthedport.com

self-sciencelabs.com

scandicpack.com

hold-sometimes.xyz

beiputei.com

yourrealtorcoach.com

rxods.com

fundsoption.com

ahlstromclothes.com

ksdieselparts.com

accountmangerford.com

kuwaitlogistic.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c54014c8c3d524d217670b262e5cfc4b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c54014c8c3d524d217670b262e5cfc4b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\c54014c8c3d524d217670b262e5cfc4b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\c54014c8c3d524d217670b262e5cfc4b_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:5080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3152-8-0x00000000059F0000-0x0000000005A46000-memory.dmp

    Filesize

    344KB

  • memory/3152-9-0x0000000006870000-0x0000000006886000-memory.dmp

    Filesize

    88KB

  • memory/3152-2-0x0000000007C10000-0x0000000007CA4000-memory.dmp

    Filesize

    592KB

  • memory/3152-3-0x000000000AD40000-0x000000000ADDC000-memory.dmp

    Filesize

    624KB

  • memory/3152-4-0x000000000B390000-0x000000000B934000-memory.dmp

    Filesize

    5.6MB

  • memory/3152-5-0x000000000ADE0000-0x000000000AE72000-memory.dmp

    Filesize

    584KB

  • memory/3152-6-0x00000000056D0000-0x00000000056DA000-memory.dmp

    Filesize

    40KB

  • memory/3152-7-0x0000000074900000-0x00000000750B0000-memory.dmp

    Filesize

    7.7MB

  • memory/3152-1-0x0000000000D00000-0x0000000000DCE000-memory.dmp

    Filesize

    824KB

  • memory/3152-10-0x000000007490E000-0x000000007490F000-memory.dmp

    Filesize

    4KB

  • memory/3152-0-0x000000007490E000-0x000000007490F000-memory.dmp

    Filesize

    4KB

  • memory/3152-11-0x0000000074900000-0x00000000750B0000-memory.dmp

    Filesize

    7.7MB

  • memory/3152-12-0x0000000006E30000-0x0000000006ED0000-memory.dmp

    Filesize

    640KB

  • memory/3152-13-0x00000000074B0000-0x00000000074DE000-memory.dmp

    Filesize

    184KB

  • memory/3152-16-0x0000000074900000-0x00000000750B0000-memory.dmp

    Filesize

    7.7MB

  • memory/5080-14-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/5080-17-0x00000000017E0000-0x0000000001B2A000-memory.dmp

    Filesize

    3.3MB