Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2025, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_08e058f3517660c18f672aa364a07215.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_08e058f3517660c18f672aa364a07215.exe
-
Size
52KB
-
MD5
08e058f3517660c18f672aa364a07215
-
SHA1
f871d71dbde5c46759163f0c1c28f9130a45e988
-
SHA256
4fe5aa82871c89df180a7f5c8278a9595a78acf15442aa2f77c63c4b3893df3a
-
SHA512
742232fe5d37197c63b1c702922e6fc54904c2def0f1fc012e2570e6203e78e3be81ccce2cf8278e21ebd027926085b876fd702110d18966a78f8778079d59f2
-
SSDEEP
768:Zejxt2/DzDLmYNv0L+CP4gEWSJPlFHXNSOAXHeAg8bs3Qa7wLJrz2v9W2GBB1UR/:ZGGLXyYF0CCP44SnFU1XN/2vg2G71PO3
Malware Config
Signatures
-
Detect XtremeRAT payload 3 IoCs
resource yara_rule behavioral2/memory/3492-15-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral2/memory/4540-17-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral2/memory/3492-20-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Executes dropped EXE 1 IoCs
pid Process 4540 winupdcenter.exe -
resource yara_rule behavioral2/files/0x0007000000023c6c-12.dat upx behavioral2/memory/4540-13-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/3492-15-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/4540-17-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral2/memory/3492-20-0x0000000010000000-0x000000001004D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4920 3492 WerFault.exe 84 3028 3492 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdcenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2220 wrote to memory of 4540 2220 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 83 PID 2220 wrote to memory of 4540 2220 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 83 PID 2220 wrote to memory of 4540 2220 JaffaCakes118_08e058f3517660c18f672aa364a07215.exe 83 PID 4540 wrote to memory of 3492 4540 winupdcenter.exe 84 PID 4540 wrote to memory of 3492 4540 winupdcenter.exe 84 PID 4540 wrote to memory of 3492 4540 winupdcenter.exe 84 PID 4540 wrote to memory of 3492 4540 winupdcenter.exe 84 PID 4540 wrote to memory of 100 4540 winupdcenter.exe 85 PID 4540 wrote to memory of 100 4540 winupdcenter.exe 85 PID 4540 wrote to memory of 100 4540 winupdcenter.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08e058f3517660c18f672aa364a07215.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08e058f3517660c18f672aa364a07215.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\winupdcenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 4884⤵
- Program crash
PID:4920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 4764⤵
- Program crash
PID:3028
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3492 -ip 34921⤵PID:1196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3492 -ip 34921⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5a00121c2f045a8f12c9a51a9b3872cb5
SHA15cdec4fc03894fbe452156543f2ec4fd72368ae8
SHA256438d8db46e231e9bd86b469eaaa924924ed69362008a3fc7dd589f4fc105846c
SHA51298b947e4cb98085b0fbfae69230b09ea6412773c72edd9e69cea0525d2a524c79965003779e1e7aa9150a5d861e4ac9b2e722de87f4c03a54be2bee898d8c780