Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/01/2025, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe
-
Size
433KB
-
MD5
2ea682eee8468fdee8f1361934625225
-
SHA1
264c0d6f5722df8f4480ffd14a89ea8a982bfe3e
-
SHA256
a8a39400f62a9033bc9c447cca7c5b69a66555fbfe5913a5d773503d9f1cad9b
-
SHA512
d17b8c12b52b970b0295339b8348820743f4729adbd8101b06dbd307b307ecb550778d22a88393cccf2a8e36f822af1319a050ff8c8ba4042a2cd765bb1cfdc4
-
SSDEEP
12288:vbRN4YywAwR2TlHAqNiw18kPKlGR0zp4U:v9N4/wR2hDekPcGR8
Malware Config
Extracted
gcleaner
gcl-gb.biz
45.9.20.13
Signatures
-
Gcleaner family
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Onlylogger family
-
OnlyLogger payload 4 IoCs
resource yara_rule behavioral1/memory/1712-2-0x0000000000400000-0x000000000044C000-memory.dmp family_onlylogger behavioral1/memory/1712-4-0x0000000000400000-0x000000000044C000-memory.dmp family_onlylogger behavioral1/memory/1712-5-0x0000000000400000-0x000000000089B000-memory.dmp family_onlylogger behavioral1/memory/1712-3-0x0000000000400000-0x000000000089B000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 2140 cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 888 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 888 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2140 1712 JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe 30 PID 1712 wrote to memory of 2140 1712 JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe 30 PID 1712 wrote to memory of 2140 1712 JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe 30 PID 1712 wrote to memory of 2140 1712 JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe 30 PID 2140 wrote to memory of 888 2140 cmd.exe 32 PID 2140 wrote to memory of 888 2140 cmd.exe 32 PID 2140 wrote to memory of 888 2140 cmd.exe 32 PID 2140 wrote to memory of 888 2140 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe" & exit2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "JaffaCakes118_2ea682eee8468fdee8f1361934625225.exe" /f3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-