Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 12:39
Behavioral task
behavioral1
Sample
f802b9aa240d1952e7500ba68ef1041c_JaffaCakes118.dll
Resource
win7-20240215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f802b9aa240d1952e7500ba68ef1041c_JaffaCakes118.dll
Resource
win10v2004-20240412-en
7 signatures
150 seconds
General
-
Target
f802b9aa240d1952e7500ba68ef1041c_JaffaCakes118.dll
-
Size
78KB
-
MD5
f802b9aa240d1952e7500ba68ef1041c
-
SHA1
2bf81ff03021ee652d8357f838ecc5b7b60d36fa
-
SHA256
582b3bcac3040df7fa81acdb518e95622684b44056ad16df877df7b4c60bcc13
-
SHA512
e6745f9a6df0974bbcb1abc113d8e8ff9bfd47512ecbe75bc5f782b7ee82af1bdaaf0f90f1cf8b796c69e60f48c688fc2f1d04a38e3bbd86d62c20c491e6fb8e
-
SSDEEP
1536:QG13wsWOEsl03OHEJfZPMdDCDPzrScnEcsW+zO6bJspsMnouy8yZF1APsu:RRmsl0RJMDCvrd+9tWouty/
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\__adware2__ = "{A6545356-3054-4943-B827-E2BBEC429255}" rundll32.exe -
resource yara_rule behavioral2/memory/1380-0-0x0000000010000000-0x0000000010032000-memory.dmp upx -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://gomyron.com/NjU2NA==/2/3560/homepage/" rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6545356-3054-4943-B827-E2BBEC429255}\InProcServer32\ = "C:\\Windows\\__adware2__.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6545356-3054-4943-B827-E2BBEC429255}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6545356-3054-4943-B827-E2BBEC429255} rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1380 rundll32.exe 1380 rundll32.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1380 rundll32.exe 1380 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3120 wrote to memory of 1380 3120 rundll32.exe 83 PID 3120 wrote to memory of 1380 3120 rundll32.exe 83 PID 3120 wrote to memory of 1380 3120 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f802b9aa240d1952e7500ba68ef1041c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f802b9aa240d1952e7500ba68ef1041c_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380
-