Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 22:25
Behavioral task
behavioral1
Sample
61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll
-
Size
23KB
-
MD5
61a5c1e6e418d7906bd44be16330a4db
-
SHA1
a5a686192eb36bf9d0f122bf9e9ce935f562ea2f
-
SHA256
d7dc17da99d3c282ec83390aa1c6a1d35f376828af5d8c316a9bbe869739f4a8
-
SHA512
7fc4c70001783f178cdd4433af94d8996451ffc70bfc859c8949c08ef233784c1273b37a7bba4878901648124a4fa834333fa12f0f594ac386f1c8e06546e79f
-
SSDEEP
384:hEPr9ELaEb+GDub3sZ9JHVGNsG/JFVqsgHH6InvJbGzYxOxDmaj7kQYIefM9b:qDwNbQb3sZ9JHVGN7hTqX6IvJb2sYmaD
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\btw3a.sys rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\btw3a.sys\ = "Driver" rundll32.exe -
resource yara_rule behavioral1/memory/1604-0-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/1604-1-0x0000000010000000-0x0000000010041000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\z98v.bin rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe 1604 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1604 2584 rundll32.exe 30 PID 2584 wrote to memory of 1604 2584 rundll32.exe 30 PID 2584 wrote to memory of 1604 2584 rundll32.exe 30 PID 2584 wrote to memory of 1604 2584 rundll32.exe 30 PID 2584 wrote to memory of 1604 2584 rundll32.exe 30 PID 2584 wrote to memory of 1604 2584 rundll32.exe 30 PID 2584 wrote to memory of 1604 2584 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll,#12⤵
- Modifies firewall policy service
- Impair Defenses: Safe Mode Boot
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
PID:1604
-