Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe
-
Size
512KB
-
MD5
0aeb3be326df43129cfb31d10aea8c10
-
SHA1
7442e98726a1d5d9133f3172588b16d793158e8e
-
SHA256
fbe7eee5f2cc32b619fd3620ab5000a77786e59c29b2c635b4cc4b82e8c7c9b5
-
SHA512
cbc53a813c3e1fc6849c7ce176cd3e7d78b6e2f52fa94ff1f7aa6457e220111ebddf96dcaa1a466bae4e0a2af3b7b31a1f6bd988ffb5acef1e4fefc07035136f
-
SSDEEP
12288:KnAvbugs1YN5OuIg10tiFQO/WZScKAtgzHDd3xg0QiuB76sel:NvbDVIFYzWwAkh35o7
Malware Config
Extracted
raccoon
723d14b565e8f39294f31f86b0ce56cdaee75105
-
url4cnc
http://telegatt.top/jdiamond13
http://telegka.top/jdiamond13
http://telegin.top/jdiamond13
https://t.me/jdiamond13
Signatures
-
Raccoon Stealer V1 payload 5 IoCs
resource yara_rule behavioral1/memory/3008-2-0x0000000000220000-0x00000000002AE000-memory.dmp family_raccoon_v1 behavioral1/memory/3008-3-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 behavioral1/memory/3008-6-0x0000000000220000-0x00000000002AE000-memory.dmp family_raccoon_v1 behavioral1/memory/3008-5-0x0000000000400000-0x00000000007B2000-memory.dmp family_raccoon_v1 behavioral1/memory/3008-7-0x0000000000400000-0x0000000000491000-memory.dmp family_raccoon_v1 -
Raccoon family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0aeb3be326df43129cfb31d10aea8c10.exe