Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 22:25
Behavioral task
behavioral1
Sample
61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll
-
Size
23KB
-
MD5
61a5c1e6e418d7906bd44be16330a4db
-
SHA1
a5a686192eb36bf9d0f122bf9e9ce935f562ea2f
-
SHA256
d7dc17da99d3c282ec83390aa1c6a1d35f376828af5d8c316a9bbe869739f4a8
-
SHA512
7fc4c70001783f178cdd4433af94d8996451ffc70bfc859c8949c08ef233784c1273b37a7bba4878901648124a4fa834333fa12f0f594ac386f1c8e06546e79f
-
SSDEEP
384:hEPr9ELaEb+GDub3sZ9JHVGNsG/JFVqsgHH6InvJbGzYxOxDmaj7kQYIefM9b:qDwNbQb3sZ9JHVGN7hTqX6IvJb2sYmaD
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\btw3a.sys rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\btw3a.sys\ = "Driver" rundll32.exe -
resource yara_rule behavioral2/memory/2140-0-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral2/memory/2140-1-0x0000000010000000-0x0000000010041000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\z98v.bin rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 644 wrote to memory of 2140 644 rundll32.exe 84 PID 644 wrote to memory of 2140 644 rundll32.exe 84 PID 644 wrote to memory of 2140 644 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61a5c1e6e418d7906bd44be16330a4db_JaffaCakes118.dll,#12⤵
- Modifies firewall policy service
- Impair Defenses: Safe Mode Boot
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
PID:2140
-