Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
6bc8466e6df854ba5b8cee8c1731f145
-
SHA1
e4a5e419e2f1c05a9531e1af6fac85b53eb8deeb
-
SHA256
af756a44f94d5084891d9fc3ee12c3d428e5337370c7ab7f07c7721d27738fd7
-
SHA512
d010f63e3d40b665a75f2860995f3257daede5c7fd1aee42e21d199b69a8af1999c611eb98e6448c7be8fe9047ddc07ce81f68bf8928635cda504ac4ba49f09a
-
SSDEEP
24576:0nZ+3tXsYjptSPJ1ABLRLEgX3bBRPSMS9ij4JWb+B36L:0nZ05setSR1qtLESR6MOiD+M
Malware Config
Extracted
danabot
4
142.11.192.232:443
192.119.110.73:443
142.11.242.31:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2752 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe 2752 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31 PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31 PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31 PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31 PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31 PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31 PID 2748 wrote to memory of 2752 2748 6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6bc8466e6df854ba5b8cee8c1731f145_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6BC846~1.DLL,s C:\Users\Admin\AppData\Local\Temp\6BC846~1.EXE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5c00ae3d536a74e22ddfaad8e2e76cb98
SHA1a7ee4de67fb30ce482c9b74e2e909f9d495beda2
SHA256c09a7963607553dc11ff59faf9cfc8d0aa528ce9ab07c8b573ae17ca2a00f059
SHA51234f37ef1dc9a81cb3ddfe14c66e7a1a6cb8ebdbe25ec15cde8b89927fbcf48ab95ca23c5a31fcba89641b5c455d8c7bce3ca07db823ec77fc9f793ae1e53c2fc