Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3JaffaCakes...b8.exe
windows7-x64
10JaffaCakes...b8.exe
windows10-2004-x64
10JaffaCakes...b8.exe
android-9-x86
JaffaCakes...b8.exe
android-10-x64
JaffaCakes...b8.exe
android-11-x64
JaffaCakes...b8.exe
macos-10.15-amd64
JaffaCakes...b8.exe
ubuntu-18.04-amd64
JaffaCakes...b8.exe
debian-9-armhf
JaffaCakes...b8.exe
debian-9-mips
JaffaCakes...b8.exe
debian-9-mipsel
Analysis
-
max time kernel
895s -
max time network
898s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral4
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral5
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral6
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
macos-20241101-en
Behavioral task
behavioral7
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral8
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral10
Sample
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe
-
Size
156KB
-
MD5
dbf61f566a642cdd0df3fc1d078debb8
-
SHA1
0294ef20386693a5699bc4e57653f966f0eaf028
-
SHA256
aead3b29e4eb3a2c5499b67eb81a609bd85944a1d7ec6b9557be527a0c566929
-
SHA512
4de09065e244d791d8c909a1c6cd689063f8318af2648498f9cf435be19b666aba096f1b2946a75200cacee5a63d705fb545c42a9d6f7a5dbf49d3cd0865467c
-
SSDEEP
3072:bqOQcs8pmp5W4J44tDlsAU/UwtRUsUUc2fjRs+DVs+A1+HX5wsOZ4T3EMXckbNGV:bqLl2V7H6sA4bEMXc4VLvTGc
Malware Config
Extracted
asyncrat
0.5.7B
Default
winx.xcapdatap.capetown:6204
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
resource yara_rule behavioral1/memory/1088-6-0x0000000000B00000-0x0000000000B18000-memory.dmp rezer0 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1088 set thread context of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1188 schtasks.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1188 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 31 PID 1088 wrote to memory of 1188 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 31 PID 1088 wrote to memory of 1188 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 31 PID 1088 wrote to memory of 1188 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 31 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33 PID 1088 wrote to memory of 2904 1088 JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PqVwJtjSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp367B.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dbf61f566a642cdd0df3fc1d078debb8.exe"{path}"2⤵
- System Location Discovery: System Language Discovery
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ac08641f7ac8ff08558fc6ba8df7cc30
SHA180c2f3e75f1dc72f57472cab7287535d363e4e68
SHA2562ab60fbaee73ea4d342cda277cc432be33b73db207cbd89b1d4056f17f93f5e2
SHA51287fae00c1e0baa4864359657985a7beae9260d13652323cd4c24a187d0f2a8a67c57f9055021d8ceb0c891840d22bdd87d89cbb85af32743a840797b0786830b