Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 05:07
Behavioral task
behavioral1
Sample
8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll
-
Size
166KB
-
MD5
8d6ee5d168c4ebe39ef2816d0c789e84
-
SHA1
d13143b8cc7d1e569202d7dfe01dc901b6517a28
-
SHA256
0e354b0a3dae3616280ca94e128efaa0dff8484848336651ae86766a92a3d6c3
-
SHA512
c812468e071bd86498273ec293d983d749eecb695bc38ba7a3af87f099bffafc71099078628276c57741c05a0c7bb4afa246db4e20f219e6cd68969b719e3a02
-
SSDEEP
3072:KgEvGJcoMSW6MFG1Yb3bdYTqaiZtjBG6o7+yT74Xff0DGzD74t0PCal:KgE+Js6ZidHTjg7+yAXj3uHO
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\DCOM Server 25319 = "{2C1CD3D7-86AC-4068-93BC-A02304B25319}" rundll32.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 2 2684 rundll32.exe 3 2684 rundll32.exe 6 2684 rundll32.exe 7 2684 rundll32.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundll32.exe -
resource yara_rule behavioral1/memory/2684-1-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-2-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-3-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-5-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-8-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-11-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-14-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx behavioral1/memory/2684-15-0x00000000021F0000-0x0000000002F1F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B25319}\InProcServer32\ThreadingModel = "Apartment" rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2684 1504 rundll32.exe 31 PID 1504 wrote to memory of 2684 1504 rundll32.exe 31 PID 1504 wrote to memory of 2684 1504 rundll32.exe 31 PID 1504 wrote to memory of 2684 1504 rundll32.exe 31 PID 1504 wrote to memory of 2684 1504 rundll32.exe 31 PID 1504 wrote to memory of 2684 1504 rundll32.exe 31 PID 1504 wrote to memory of 2684 1504 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d6ee5d168c4ebe39ef2816d0c789e84_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Blocklisted process makes network request
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2684
-