Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe
-
Size
122KB
-
MD5
39d801f58ce55e868801333e3dacce6d
-
SHA1
ba1cd7fe13b6413b3d6df00392727cad81fdb058
-
SHA256
51a99ba9672c9be5b7da59bc033b12726d70460d5f9ff7c8c599db73c17d6f8a
-
SHA512
44bc77acd925500cbab39e6dd073cdf1ce5ef5c054da57a8f6d822fd50c6a7eaf2f71afaf99340246e080c7262e10de6d581727701c39fef5aae3d20807f78cf
-
SSDEEP
3072:piBiyJ+MgpIOszYpew6bI/5hoqNz2OUKCXoA2n+Hx/do:GiysMq+Yt6K5KNzokR
Malware Config
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral1/memory/2272-11-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2272-21-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2272-17-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2272-15-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2272-14-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat behavioral1/memory/2272-9-0x0000000000C80000-0x0000000000C92000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Disables Task Manager via registry modification
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ycpoFJLDcrjUCE = "C:\\Users\\Admin\\AppData\\Roaming\\JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe" JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe" JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1836 set thread context of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2800 REG.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1836 wrote to memory of 2800 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 30 PID 1836 wrote to memory of 2800 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 30 PID 1836 wrote to memory of 2800 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 30 PID 1836 wrote to memory of 2800 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 30 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32 PID 1836 wrote to memory of 2272 1836 JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39d801f58ce55e868801333e3dacce6d.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2800
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:2272
-