Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe
-
Size
223KB
-
MD5
88bdbcaac918aecc7d234869c72ad4cd
-
SHA1
32ec06a262002d09df0c4572818885215fc91f16
-
SHA256
27af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175
-
SHA512
06ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4
-
SSDEEP
6144:RYZe7PheEH+UEuQTs+NLIj13/zQ2I56EvcZnjbTo6:ie7PhIUXcn813bc56Eoo6
Malware Config
Extracted
xtremerat
untra.no-ip.biz
Signatures
-
Detect XtremeRAT payload 4 IoCs
resource yara_rule behavioral2/memory/1936-18-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/1240-87-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/2084-102-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat behavioral2/memory/3716-105-0x0000000000C80000-0x0000000000CA1000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2} JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H285T2W7-608M-1G1P-BJQS-IB10AI67G7X2}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe -
Executes dropped EXE 1 IoCs
pid Process 3716 Server.exe -
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral2/files/0x0008000000023c9e-22.dat molebox -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\InstallDir\Server.exe JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe File opened for modification C:\Windows\InstallDir\ JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe File opened for modification C:\Windows\InstallDir\Server.exe Server.exe File opened for modification C:\Windows\InstallDir\Server.exe JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1240 wrote to memory of 1936 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 86 PID 1240 wrote to memory of 1936 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 86 PID 1240 wrote to memory of 1936 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 86 PID 1240 wrote to memory of 1936 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 86 PID 1240 wrote to memory of 1384 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 87 PID 1240 wrote to memory of 1384 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 87 PID 1240 wrote to memory of 1384 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 87 PID 1240 wrote to memory of 2528 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 88 PID 1240 wrote to memory of 2528 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 88 PID 1240 wrote to memory of 2528 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 88 PID 1240 wrote to memory of 1308 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 92 PID 1240 wrote to memory of 1308 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 92 PID 1240 wrote to memory of 1308 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 92 PID 1240 wrote to memory of 4584 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 93 PID 1240 wrote to memory of 4584 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 93 PID 1240 wrote to memory of 4584 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 93 PID 1240 wrote to memory of 4036 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 94 PID 1240 wrote to memory of 4036 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 94 PID 1240 wrote to memory of 4036 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 94 PID 1240 wrote to memory of 4476 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 95 PID 1240 wrote to memory of 4476 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 95 PID 1240 wrote to memory of 4476 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 95 PID 1240 wrote to memory of 4760 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 96 PID 1240 wrote to memory of 4760 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 96 PID 1240 wrote to memory of 4760 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 96 PID 1240 wrote to memory of 3424 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 97 PID 1240 wrote to memory of 3424 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 97 PID 1240 wrote to memory of 3716 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 98 PID 1240 wrote to memory of 3716 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 98 PID 1240 wrote to memory of 3716 1240 JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe 98 PID 3716 wrote to memory of 2084 3716 Server.exe 99 PID 3716 wrote to memory of 2084 3716 Server.exe 99 PID 3716 wrote to memory of 2084 3716 Server.exe 99 PID 3716 wrote to memory of 2084 3716 Server.exe 99 PID 3716 wrote to memory of 4892 3716 Server.exe 101 PID 3716 wrote to memory of 4892 3716 Server.exe 101 PID 3716 wrote to memory of 4892 3716 Server.exe 101 PID 3716 wrote to memory of 1388 3716 Server.exe 102 PID 3716 wrote to memory of 1388 3716 Server.exe 102 PID 3716 wrote to memory of 1388 3716 Server.exe 102 PID 3716 wrote to memory of 1108 3716 Server.exe 103 PID 3716 wrote to memory of 1108 3716 Server.exe 103 PID 3716 wrote to memory of 1108 3716 Server.exe 103 PID 3716 wrote to memory of 3912 3716 Server.exe 104 PID 3716 wrote to memory of 3912 3716 Server.exe 104 PID 3716 wrote to memory of 3912 3716 Server.exe 104 PID 3716 wrote to memory of 1832 3716 Server.exe 105 PID 3716 wrote to memory of 1832 3716 Server.exe 105 PID 3716 wrote to memory of 1832 3716 Server.exe 105 PID 3716 wrote to memory of 2988 3716 Server.exe 106 PID 3716 wrote to memory of 2988 3716 Server.exe 106 PID 3716 wrote to memory of 2988 3716 Server.exe 106 PID 3716 wrote to memory of 3480 3716 Server.exe 107 PID 3716 wrote to memory of 3480 3716 Server.exe 107 PID 3716 wrote to memory of 3480 3716 Server.exe 107 PID 3716 wrote to memory of 2548 3716 Server.exe 108 PID 3716 wrote to memory of 2548 3716 Server.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:3424
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:2548
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ac1d2bca380d4ac39ad85858c0da66c
SHA18b516be02176276f8a91206c5406b66b8f955838
SHA256a580f404a677790dfacffd10b238010b84fb783dfb95afcd937789e9eb274a2a
SHA512ed9619a10c32aa0637dbf4c0a0869b928e82b329ae7bc776cec1452c56c02ad0c76474fe9156c5e29ee336cb6a5af4f506bc9e11ce60194e8dcce4f62afa49b7
-
Filesize
223KB
MD588bdbcaac918aecc7d234869c72ad4cd
SHA132ec06a262002d09df0c4572818885215fc91f16
SHA25627af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175
SHA51206ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4