Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 11:05
Behavioral task
behavioral1
Sample
19e2cd5915507464b87296dac4d300a6_JaffaCakes118.dll
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
19e2cd5915507464b87296dac4d300a6_JaffaCakes118.dll
-
Size
97KB
-
MD5
19e2cd5915507464b87296dac4d300a6
-
SHA1
fdbf441dc9de9033ccfe963150aa79da14ede55a
-
SHA256
12b2aeed98b868f4f5a5924032c1042c2b3cfe6fff930292cdaf8bce83a8068c
-
SHA512
a8843e103b7bde0664e0953c192316ad22f2af9dbf8278db4a68a824eb3b45105acefb16c76cfad25c998775eff1dffc4dca3f1ec8cea2bd2d388bbbb06184df
-
SSDEEP
1536:NwOuUBn/AbxM534x7y8owbyw/wv3acSt0fe98uQTw3wNb3ATz:Nru7xMobFY3a5tme98HTw3wNb3ATz
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/memory/1796-0-0x0000000010000000-0x000000001001B000-memory.dmp family_gh0strat behavioral1/memory/1796-1-0x0000000010000000-0x000000001001B000-memory.dmp family_gh0strat behavioral1/memory/1796-2-0x0000000010000000-0x000000001001B000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1796 1916 rundll32.exe 28 PID 1916 wrote to memory of 1796 1916 rundll32.exe 28 PID 1916 wrote to memory of 1796 1916 rundll32.exe 28 PID 1916 wrote to memory of 1796 1916 rundll32.exe 28 PID 1916 wrote to memory of 1796 1916 rundll32.exe 28 PID 1916 wrote to memory of 1796 1916 rundll32.exe 28 PID 1916 wrote to memory of 1796 1916 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19e2cd5915507464b87296dac4d300a6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19e2cd5915507464b87296dac4d300a6_JaffaCakes118.dll,#12⤵
- Drops file in Drivers directory
PID:1796
-