Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2025, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe
-
Size
616KB
-
MD5
d118b4c9ab86717e36c9f2fc6bf7be56
-
SHA1
bd4f36443ef11158caf0bd2c6c932fdc1d6903dc
-
SHA256
37a101ec34e0a952b841554cd7e9f78091166c8e6c5f352da65fbabdaf7ec146
-
SHA512
f6b87599e4b8681202d7c6f1e0d7e6a061fcb958e380108afed70f8c1a78809d984b2dc2ed9e8bed079c32c084b409cf26c70c75268901080a5e0ff1259fa7a6
-
SSDEEP
12288:7ypMe9AlMc2737t1dqsBl+7V7kPH/kpJQ59D6uuPbJ0TbCNjg:7xB2737tzqs67bQ5J6uuPbJ8Cjg
Malware Config
Extracted
xloader
2.5
hqvn
foodhub-pay-link.com
signalplusnigeria.com
unprocreated.info
fondidal1936.com
opendialogmonaco.com
labessentials.xyz
scientechic.com
lakesidepointeatlakenorman.com
teklis.biz
jibberes.info
dellere.com
camaras.store
car2govancouver.com
maximizer.icu
morningafterskin.com
kode-buy.com
stogecoin.com
grv.digital
weihao-autoparts.com
jhaww.com
companyintel.zone
catoctindev.com
mantarents.com
companycounsellor.com
respectgodalmighty.com
eltakito.com
graphics-experts.com
9963d.com
pricelessofficial.com
southwestfigures.com
medispatch.com
bubblewauw.com
update-mind.com
vmyfu.xyz
threer.net
nixieranceagama.com
golpoalo.com
marianomingotes.com
europe-lodging.com
rvcommand.online
dataly.tech
ventura-taxi.com
osakatunis.com
experienceanewexclusive.com
zjnbgf.com
dualipatulsa.com
hjuzlounge.com
giftcodefreefirevns.com
stockholmtrends.com
undefineds.com
humocto.com
ktnstill.xyz
kshuapin.com
tam-solutions.com
ledgergold.net
plantspool.com
isnards.com
blantontransport.com
sh-spgdk.com
costsma.net
moukse.com
wellsonstv.com
citycentredesignweek.com
kienkhop.online
melvinmmiller.com
Signatures
-
Xloader family
-
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/2556-2-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 920 set thread context of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2556 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 2556 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 920 wrote to memory of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82 PID 920 wrote to memory of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82 PID 920 wrote to memory of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82 PID 920 wrote to memory of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82 PID 920 wrote to memory of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82 PID 920 wrote to memory of 2556 920 JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d118b4c9ab86717e36c9f2fc6bf7be56.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556
-