Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll
-
Size
451KB
-
MD5
8b141f034205fae56a4bc7e82b830cfc
-
SHA1
0e4fe98c6c0d20941a59e62b1109c033c639f715
-
SHA256
d7e3760fcc1324aef1d78035e02566fe575a29fcd0dbe7287a37459a42ffcdbd
-
SHA512
e206c3e4c600376bfa073674b4818808883d022f352e27b0cbd52abe1b332b50e9d15612b418a9b07e74a4ec01c7c9ea93d59238aab66cb569a5cb63504ca388
-
SSDEEP
12288:ofO5ZXvRjuyj6GaJTOoiN6WxSC5L/+UzEO:F/XxuZ2dxP3YO
Malware Config
Extracted
trickbot
100011
mon54
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
-
autorunName:pwgrab
Signatures
-
resource yara_rule behavioral2/memory/4752-2-0x0000000010000000-0x0000000012055000-memory.dmp templ_dll behavioral2/memory/4752-6-0x0000000010000000-0x0000000012072000-memory.dmp templ_dll -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3280 wermgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4640 wrote to memory of 4752 4640 rundll32.exe 84 PID 4640 wrote to memory of 4752 4640 rundll32.exe 84 PID 4640 wrote to memory of 4752 4640 rundll32.exe 84 PID 4752 wrote to memory of 3436 4752 rundll32.exe 87 PID 4752 wrote to memory of 3436 4752 rundll32.exe 87 PID 4752 wrote to memory of 3280 4752 rundll32.exe 88 PID 4752 wrote to memory of 3280 4752 rundll32.exe 88 PID 4752 wrote to memory of 3280 4752 rundll32.exe 88 PID 4752 wrote to memory of 3280 4752 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵PID:3436
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-