Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe
-
Size
497KB
-
MD5
b0fcf3f4e8a1443c4822a0fa37460695
-
SHA1
98b2a1484803f0c1057695d2eba5801e670ed63b
-
SHA256
76d1425757fcdb4c6ddac28a2c7970e743d0f1bf240101d701fc32d5420487cf
-
SHA512
998b62550107d48146e9abf526537eda8e88f2878e1d9669b2755ab21d02fbfc9c8173221f61a03ddd26231c8cebc5d1a7ff285c08bfaf29d377f9c7ae4cb620
-
SSDEEP
6144:dZ6PRR6gpvGa9q4A8olUpR1rhhegYUBPsUpxd4CNooxb:dZ6PRH5Ga285rh99BPtxd9SoV
Malware Config
Extracted
remcos
RemoteHost
185.208.211.10:1339
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-JEH3DS
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
90
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
2.0.4 Pro
RemoteHost
185.208.211.10:1339
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-JEH3DS
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
90
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Albt.lnk JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calc.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 4132 calc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82 PID 976 wrote to memory of 4132 976 JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b0fcf3f4e8a1443c4822a0fa37460695.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\calc.execalc.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79B
MD5691d2521d209569e247449cd447feafd
SHA11e37ec3ab6fbb8b8608f4b6b252d70a9235417e6
SHA2560bb0c49de763c23e113a76b46b93d698d7f5274dc88dfbf668d7e87a337d0061
SHA512ac633a0d02696a1b445ed8af1fba7b27d021d026bda893da9399829d7d4b70da946949ef0fd12010d7df8d2db115b8545f7bf0f841e1292fd47b37b2bfb2b09f