Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 00:22
Behavioral task
behavioral1
Sample
b170e40d47a014f9803178cfef259391_JaffaCakes118.dll
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
b170e40d47a014f9803178cfef259391_JaffaCakes118.dll
-
Size
155KB
-
MD5
b170e40d47a014f9803178cfef259391
-
SHA1
42e7c2052d509462a2310f32fa9c0ed54ded521c
-
SHA256
fa16b3c1b58b4f354e66a04787fdc0c3e29342addcec16a9f3a168f5d4c395f2
-
SHA512
44cbec6fe9f19f9a2914486f9be53f4029553558f75735ec3016b9af0a98826f6e5b4a8faa6846b8408974d7b3797481cced18eb215ce1c888945aa5c2c88ec5
-
SSDEEP
3072:PBWHWVKhqPEzO/V1VrNYQkCA+HFSWvs3TBftrnob2i:5WHg9DNYtEHhvs3TBlrnobD
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4772-0-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat -
Program crash 1 IoCs
pid pid_target Process procid_target 3628 4772 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4772 4884 rundll32.exe 84 PID 4884 wrote to memory of 4772 4884 rundll32.exe 84 PID 4884 wrote to memory of 4772 4884 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b170e40d47a014f9803178cfef259391_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b170e40d47a014f9803178cfef259391_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 6003⤵
- Program crash
PID:3628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4772 -ip 47721⤵PID:3596