Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_08e058f3517660c18f672aa364a07215.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_08e058f3517660c18f672aa364a07215.exe
-
Size
52KB
-
MD5
08e058f3517660c18f672aa364a07215
-
SHA1
f871d71dbde5c46759163f0c1c28f9130a45e988
-
SHA256
4fe5aa82871c89df180a7f5c8278a9595a78acf15442aa2f77c63c4b3893df3a
-
SHA512
742232fe5d37197c63b1c702922e6fc54904c2def0f1fc012e2570e6203e78e3be81ccce2cf8278e21ebd027926085b876fd702110d18966a78f8778079d59f2
-
SSDEEP
768:Zejxt2/DzDLmYNv0L+CP4gEWSJPlFHXNSOAXHeAg8bs3Qa7wLJrz2v9W2GBB1UR/:ZGGLXyYF0CCP44SnFU1XN/2vg2G71PO3
Malware Config
Signatures
-
Detect XtremeRAT payload 4 IoCs
resource yara_rule behavioral1/memory/2392-12-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2572-15-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2392-16-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral1/memory/2572-18-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Executes dropped EXE 1 IoCs
pid Process 2392 winupdcenter.exe -
resource yara_rule behavioral1/files/0x0008000000015d79-10.dat upx behavioral1/memory/2392-12-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2572-15-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2392-16-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral1/memory/2572-18-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdcenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2392 2116 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 30 PID 2116 wrote to memory of 2392 2116 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 30 PID 2116 wrote to memory of 2392 2116 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 30 PID 2116 wrote to memory of 2392 2116 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 30 PID 2392 wrote to memory of 2572 2392 winupdcenter.exe 31 PID 2392 wrote to memory of 2572 2392 winupdcenter.exe 31 PID 2392 wrote to memory of 2572 2392 winupdcenter.exe 31 PID 2392 wrote to memory of 2572 2392 winupdcenter.exe 31 PID 2392 wrote to memory of 2572 2392 winupdcenter.exe 31 PID 2392 wrote to memory of 1856 2392 winupdcenter.exe 32 PID 2392 wrote to memory of 1856 2392 winupdcenter.exe 32 PID 2392 wrote to memory of 1856 2392 winupdcenter.exe 32 PID 2392 wrote to memory of 1856 2392 winupdcenter.exe 32 PID 2392 wrote to memory of 1856 2392 winupdcenter.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08e058f3517660c18f672aa364a07215.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08e058f3517660c18f672aa364a07215.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
PID:2572
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5a00121c2f045a8f12c9a51a9b3872cb5
SHA15cdec4fc03894fbe452156543f2ec4fd72368ae8
SHA256438d8db46e231e9bd86b469eaaa924924ed69362008a3fc7dd589f4fc105846c
SHA51298b947e4cb98085b0fbfae69230b09ea6412773c72edd9e69cea0525d2a524c79965003779e1e7aa9150a5d861e4ac9b2e722de87f4c03a54be2bee898d8c780