Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2025, 12:58

General

  • Target

    JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe

  • Size

    223KB

  • MD5

    88bdbcaac918aecc7d234869c72ad4cd

  • SHA1

    32ec06a262002d09df0c4572818885215fc91f16

  • SHA256

    27af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175

  • SHA512

    06ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4

  • SSDEEP

    6144:RYZe7PheEH+UEuQTs+NLIj13/zQ2I56EvcZnjbTo6:ie7PhIUXcn813bc56Eoo6

Malware Config

Extracted

Family

xtremerat

C2

untra.no-ip.biz

Signatures

  • Detect XtremeRAT payload 4 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Molebox Virtualization software 1 IoCs

    Detects file using Molebox Virtualization software.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
        PID:1936
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        2⤵
          PID:1384
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          2⤵
            PID:2528
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
            2⤵
              PID:1308
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              2⤵
                PID:4584
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                2⤵
                  PID:4036
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  2⤵
                    PID:4476
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                    2⤵
                      PID:4760
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                      2⤵
                        PID:3424
                      • C:\Windows\InstallDir\Server.exe
                        "C:\Windows\InstallDir\Server.exe"
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3716
                        • C:\Windows\SysWOW64\svchost.exe
                          svchost.exe
                          3⤵
                            PID:2084
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                            3⤵
                              PID:4892
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                              3⤵
                                PID:1388
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                3⤵
                                  PID:1108
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                  3⤵
                                    PID:3912
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                    3⤵
                                      PID:1832
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                      3⤵
                                        PID:2988
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                        3⤵
                                          PID:3480
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                          3⤵
                                            PID:2548

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

                                        Filesize

                                        1KB

                                        MD5

                                        3ac1d2bca380d4ac39ad85858c0da66c

                                        SHA1

                                        8b516be02176276f8a91206c5406b66b8f955838

                                        SHA256

                                        a580f404a677790dfacffd10b238010b84fb783dfb95afcd937789e9eb274a2a

                                        SHA512

                                        ed9619a10c32aa0637dbf4c0a0869b928e82b329ae7bc776cec1452c56c02ad0c76474fe9156c5e29ee336cb6a5af4f506bc9e11ce60194e8dcce4f62afa49b7

                                      • C:\Windows\InstallDir\Server.exe

                                        Filesize

                                        223KB

                                        MD5

                                        88bdbcaac918aecc7d234869c72ad4cd

                                        SHA1

                                        32ec06a262002d09df0c4572818885215fc91f16

                                        SHA256

                                        27af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175

                                        SHA512

                                        06ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4

                                      • memory/1240-85-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1240-2-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                        Filesize

                                        132KB

                                      • memory/1240-6-0x00000000021F0000-0x0000000002200000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1240-5-0x0000000076FC2000-0x0000000076FC3000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1240-4-0x00000000025C0000-0x00000000025D0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1240-3-0x00000000023D0000-0x00000000023E0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1240-8-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1240-9-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1240-10-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1240-87-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                        Filesize

                                        132KB

                                      • memory/1240-89-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1240-90-0x00000000020C0000-0x000000000210E000-memory.dmp

                                        Filesize

                                        312KB

                                      • memory/1240-21-0x00000000020C0000-0x000000000210E000-memory.dmp

                                        Filesize

                                        312KB

                                      • memory/1240-1-0x00000000020C0000-0x000000000210E000-memory.dmp

                                        Filesize

                                        312KB

                                      • memory/1240-73-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1240-72-0x00000000021F0000-0x0000000002200000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1240-71-0x00000000025C0000-0x00000000025D0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1240-70-0x00000000023D0000-0x00000000023E0000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1240-7-0x00000000769C0000-0x00000000769C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1240-0-0x00000000004B0000-0x00000000004B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1240-11-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1936-104-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1936-20-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/1936-18-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                        Filesize

                                        132KB

                                      • memory/2084-102-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                        Filesize

                                        132KB

                                      • memory/3716-88-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-98-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-97-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-96-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-95-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-94-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-93-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-92-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-91-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-84-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                        Filesize

                                        132KB

                                      • memory/3716-86-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-106-0x00000000769A0000-0x0000000076A90000-memory.dmp

                                        Filesize

                                        960KB

                                      • memory/3716-105-0x0000000000C80000-0x0000000000CA1000-memory.dmp

                                        Filesize

                                        132KB