Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2025, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe
-
Size
513KB
-
MD5
2ea863b6b81bb910cacf7ad6562438d3
-
SHA1
13f5dbf1f7ba7191b41ca1aea3d18035709f6744
-
SHA256
371a7fde3d56ab06c051efdd78f55fa6a142360de778646d24f713b9097048e1
-
SHA512
8461ebefd23f850522cac453d33e533d1a208ca43e8a5fa328bc99a67c9726724aa7ff23232e14a77a52fe0dff25efd08338af6359b221cfc1eefdd89384e00d
-
SSDEEP
12288:UGeKvwZe/UrHaGfb6POd+rTpOSJMvMEB7:UGeKJcrH7/d+/BMv3
Malware Config
Extracted
formbook
4.1
bs2l
file-anae.com
letsgosunderland.com
urgome.com
g5tet.xyz
myline2online.com
crafty-buck.com
uralpack.net
chinmeat.com
kursuskekipoh.com
justgantt.com
hqh.xyz
xiongege55.com
pokebrostogo.com
firststonemusic.com
bataviabento.com
comoditahandyshop.com
dayloniabeauty.com
ceeonec.com
scribblerhub.com
lindosueno.com
curatedelearning.net
seedparlour.com
veganleetruck.com
commscholar.com
syuto-ene.com
inspirainstitute.com
tmlsheltons.com
happinesssearch.com
finalstepcleaningservice.com
xcwwjzsb.com
linkmedgf.com
donnieandbrasco.com
greatestmeacademy.com
husainatalqara.com
222666dy.com
theproperconsultant.com
katherinexu.com
geredemiz.com
acres-of-loveshop.com
live-cam4sex.com
affineindia.com
oktirefwb.com
southernsoulcafe.com
wallylakesidecottages.com
zhenyanjx.com
phoebook.com
welovechurrosusa.com
sippingaggressively.com
verstechms.com
bulabluespropertiesllc.com
fallspill.com
factorycheckout.com
vanessarosejewellery.com
xn--fazlsay-tfb.com
microsoftinternational.com
xiaohe-yidian.com
favoriturizm.com
thisisdreamland.com
eatchar.com
8ky2.com
nexusurl.com
escapadogs.com
theofficialserenasolbrown.com
estambrilandia.com
amazonsfinds.com
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/456-16-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/456-21-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 396 set thread context of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 456 set thread context of 3436 456 RegSvcs.exe 56 PID 3836 set thread context of 3436 3836 cscript.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1168 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 456 RegSvcs.exe 456 RegSvcs.exe 456 RegSvcs.exe 456 RegSvcs.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe 3836 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 456 RegSvcs.exe 456 RegSvcs.exe 456 RegSvcs.exe 3836 cscript.exe 3836 cscript.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 456 RegSvcs.exe Token: SeShutdownPrivilege 3436 Explorer.EXE Token: SeCreatePagefilePrivilege 3436 Explorer.EXE Token: SeDebugPrivilege 3836 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 396 wrote to memory of 1168 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 99 PID 396 wrote to memory of 1168 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 99 PID 396 wrote to memory of 1168 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 99 PID 396 wrote to memory of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 396 wrote to memory of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 396 wrote to memory of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 396 wrote to memory of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 396 wrote to memory of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 396 wrote to memory of 456 396 JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe 101 PID 3436 wrote to memory of 3836 3436 Explorer.EXE 102 PID 3436 wrote to memory of 3836 3436 Explorer.EXE 102 PID 3436 wrote to memory of 3836 3436 Explorer.EXE 102 PID 3836 wrote to memory of 2688 3836 cscript.exe 103 PID 3836 wrote to memory of 2688 3836 cscript.exe 103 PID 3836 wrote to memory of 2688 3836 cscript.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ea863b6b81bb910cacf7ad6562438d3.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eGWSVRxsBoYDt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp17F8.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-