Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 14:02
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe
-
Size
81KB
-
MD5
789192604cc7cde75aeeb7af97d480cb
-
SHA1
2d0c60463c4a2ac7826bd10471301fbf1cefb0be
-
SHA256
affb4518c3cf5b774ce605ab3c144fd10c7c277801e9f6231bfd7a89cfb805d8
-
SHA512
a71db7edb10ffb07adef68fe51b49c091d9c1f25cf39fe578dc3caaa8480b1b60625dd79cec970b3bee0cde8d87ae97b0ecc1378de4635d82da8911168a39c3f
-
SSDEEP
1536:mG2EnTramCVTJ10e9yhVuNThKYayaGoNrE2aGINvku5SBtUG5:mynvBCVTJ10ey0NThKYSpNQGINvkuxG5
Malware Config
Signatures
-
Detect XtremeRAT payload 5 IoCs
resource yara_rule behavioral2/memory/4872-7-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4872-8-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4824-10-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4872-11-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat behavioral2/memory/4824-12-0x0000000010000000-0x0000000010048000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3132 set thread context of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 -
resource yara_rule behavioral2/memory/4872-3-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/4872-6-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/4872-7-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/4872-8-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/4824-10-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/4872-11-0x0000000010000000-0x0000000010048000-memory.dmp upx behavioral2/memory/4824-12-0x0000000010000000-0x0000000010048000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4900 4824 WerFault.exe 90 2448 4824 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 3132 wrote to memory of 4872 3132 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 89 PID 4872 wrote to memory of 4824 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 90 PID 4872 wrote to memory of 4824 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 90 PID 4872 wrote to memory of 4824 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 90 PID 4872 wrote to memory of 4824 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 90 PID 4872 wrote to memory of 4120 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 91 PID 4872 wrote to memory of 4120 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 91 PID 4872 wrote to memory of 4120 4872 JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_789192604cc7cde75aeeb7af97d480cb.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 4844⤵
- Program crash
PID:4900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 4924⤵
- Program crash
PID:2448
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4120
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4824 -ip 48241⤵PID:3872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4824 -ip 48241⤵PID:2208