Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe
-
Size
431KB
-
MD5
1d024b5fb222f690e2437776dba5cecd
-
SHA1
3bc42dd5835072842a7dbe4bc75db9480d4781e9
-
SHA256
dfa72cfd2cf8b1c3beac907a91042e344a301923e8e40b88541e850161eae6eb
-
SHA512
e1812ba005ed0d873cc43233d156f35b126d47228ec204900137f3676685a501ab1440b45d50b66b72da9114421d292f60ff1bbe817ea7200ef8c0a54cce2b51
-
SSDEEP
12288:NVKqL95GKVh5QIXIxUOCY+5JHgc/73EW6kSb836D4X4pznu:NV9NB6+5Wc/7UWobAiOMnu
Malware Config
Extracted
formbook
4.1
h0gd
hispansud.com
sanslisin156.com
izmediajo.com
fukugyo-kuchicomi.net
zjzmkj.net
powerupinnovations.com
unigradecuracao.net
inspirasimagz.com
isaacnqwilliams.store
john316graphics.net
wcparadise.net
trejoblanco.com
100x100cultura.com
beedivinehomedecor.com
polant.xyz
ascrete.com
www23855.com
emmagx.com
rekotalent.biz
fersamultiservicios.com
omaniaa.net
olusiune.xyz
shtycatur.store
private-cars.net
madduxworks.com
edhl-sa.net
vivendodesorteios.online
hec-outfits.com
onlinepoojabooking.com
sofievermeulen.com
recargas-online-virtual.online
all-wedding.com
perfectbikeshort.com
travimall.com
kxctut2.xyz
somaijobs.net
thecyber.academy
official-yukitakaoka.com
winkletest.com
anlegerschutz.review
812664.com
uniqe-base.com
roofingcompanywarren.com
thbzjs.com
tracktelevision.com
rckt-api.com
therealmccoypdfcoffee.com
dalehollowoutdoors.com
childcaregameplan.com
starbonus7.com
mturko.com
genelyn.net
swapit.press
bathroomremodelingtips.net
v60010.xyz
propertyprotect.net
dealipal.com
savefrsaom.net
sepela-food.com
thepetvetlife.com
el-balcon.com
frenda.online
sutefisufeles.xyz
trillumtrillum.com
x-surcinetenerife.com
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/3388-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3388-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3388-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3744-26-0x0000000001250000-0x000000000127F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4868 set thread context of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 3388 set thread context of 3528 3388 MSBuild.exe 56 PID 3388 set thread context of 3528 3388 MSBuild.exe 56 PID 3744 set thread context of 3528 3744 chkdsk.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3388 MSBuild.exe 3388 MSBuild.exe 3388 MSBuild.exe 3388 MSBuild.exe 3388 MSBuild.exe 3388 MSBuild.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe 3744 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3388 MSBuild.exe 3388 MSBuild.exe 3388 MSBuild.exe 3388 MSBuild.exe 3744 chkdsk.exe 3744 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3388 MSBuild.exe Token: SeDebugPrivilege 3744 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 4868 wrote to memory of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 4868 wrote to memory of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 4868 wrote to memory of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 4868 wrote to memory of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 4868 wrote to memory of 3388 4868 JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe 102 PID 3528 wrote to memory of 3744 3528 Explorer.EXE 104 PID 3528 wrote to memory of 3744 3528 Explorer.EXE 104 PID 3528 wrote to memory of 3744 3528 Explorer.EXE 104 PID 3744 wrote to memory of 1964 3744 chkdsk.exe 105 PID 3744 wrote to memory of 1964 3744 chkdsk.exe 105 PID 3744 wrote to memory of 1964 3744 chkdsk.exe 105
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1964
-
-