Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
c0a531e457d88c310d76450a843b4f88_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c0a531e457d88c310d76450a843b4f88_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c0a531e457d88c310d76450a843b4f88_JaffaCakes118.dll
-
Size
32KB
-
MD5
c0a531e457d88c310d76450a843b4f88
-
SHA1
75bf4c9f670e97dd53905dee2b82c657f0bff0d1
-
SHA256
fcacd33e24fac9820c6ff258258e6a7b34b5d3737929cc223ec0c3bf82682a5a
-
SHA512
3e5ec1a377806a39ed73ac10d93735cff0574fc6aa643684bf1ba75a612c9e4014c93c9677d6ee92dc5b30ac6f7954115465709c09c7c9fdd81ff14c3fb97d7a
-
SSDEEP
384:bUjK6lgJbhm8dC7nkJDi4YRv0z6jQ2PdqMscidj+gGZEP:bU2og5g4CYJDHYRvM6jQ2PZ7idj+RZ
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dehkj.dll rundll32.exe File created C:\Windows\SysWOW64\dtrgjy.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\dtrgjy.dll rundll32.exe File created C:\Windows\SysWOW64\dehkj.dll rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe 3068 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3068 rundll32.exe Token: SeDebugPrivilege 3068 rundll32.exe Token: SeDebugPrivilege 3068 rundll32.exe Token: SeDebugPrivilege 3068 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3044 wrote to memory of 3068 3044 rundll32.exe 30 PID 3068 wrote to memory of 1244 3068 rundll32.exe 21 PID 3068 wrote to memory of 1244 3068 rundll32.exe 21 PID 3068 wrote to memory of 944 3068 rundll32.exe 17 PID 3068 wrote to memory of 944 3068 rundll32.exe 17
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:944
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a531e457d88c310d76450a843b4f88_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a531e457d88c310d76450a843b4f88_JaffaCakes118.dll,#13⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
-
-