Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe
-
Size
483KB
-
MD5
43185ba5682dbd5b9a4aeefd052f2ba7
-
SHA1
9fb2ca5d4998c28ed9637e7f8c62e001a4a262d1
-
SHA256
ddcee2fa36f568c004181f3d91b4b75eeb935a28e9b5a3d32d1c0fd78be4fa70
-
SHA512
b7f148d97395b0ad4ba5dc0166d6e0c15df1514763a367c5518f0df771b64dee9f411a9bc295acec0a07b27d58d639704488a2c93531c5f34fa227449aba2ad0
-
SSDEEP
6144:fYG1f456Uqd2GhNAqwisAnIikwTc0gIlokyp3I5a5Kx81wHadqMWp/19SORt:QhAUi2iNA1AIikNqp15anwHadZWTL
Malware Config
Extracted
formbook
4.1
jy0b
lamejorimagen.com
mykabukibrush.com
modgon.com
barefoottherapeutics.com
shimpeg.net
trade-sniper.com
chiangkhancityhotel.com
joblessmoni.club
stespritsubways.com
chico-group.com
nni8.xyz
searchtypically.online
jobsyork.com
bestsales-crypto.com
iqmarketing.info
bullcityphotobooths.com
fwssc.icu
1oc87s.icu
usdiesel.xyz
secrets2optimumnutrition.com
charlotte-s-creations.com
homenetmidrand.com
sytypij.xyz
tapehitsscriptsparty.com
adelenashville.com
greendylife.com
agbqs.com
lilcrox.xyz
thepersonalevolutionmaven.com
graciasmiangel.com
heidisgifts.com
flchimneyspecialists.com
yorkrehabclinic.com
cent-pour-centsons.com
marcoislandsupsurf.net
expressdiagnostics.info
surferjackproductions.com
duscopy.store
uekra.tech
campaigncupgunplant.xyz
cheetahadvance.com
blickosinski.icu
laketacostahoe.com
drippysupplyco.com
isomassagegun.com
clarition.com
andrew-pillar.com
truthbudgeting.com
cloudfixr.com
cfasministries.com
compliant-now-beta.com
kssc17.icu
plewabuilders.com
uslugi-email.site
167hours.com
sodo6697.com
voyagesify.com
ranodalei.com
culturao.com
littlepotato-id.com
integtiryhvacsanmateo.com
neatmounts.com
reddictnflstream.com
digistore-maya.com
filecrev.com
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral2/memory/4672-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2364 set thread context of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 4672 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 4672 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2604 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 99 PID 2364 wrote to memory of 2604 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 99 PID 2364 wrote to memory of 2604 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 99 PID 2364 wrote to memory of 5096 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 100 PID 2364 wrote to memory of 5096 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 100 PID 2364 wrote to memory of 5096 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 100 PID 2364 wrote to memory of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101 PID 2364 wrote to memory of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101 PID 2364 wrote to memory of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101 PID 2364 wrote to memory of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101 PID 2364 wrote to memory of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101 PID 2364 wrote to memory of 4672 2364 JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"2⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"2⤵PID:5096
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_43185ba5682dbd5b9a4aeefd052f2ba7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-