Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll
-
Size
196KB
-
MD5
ebd3e0e0568f541147adc9eea081801d
-
SHA1
56bbf53e5740da4a0bdcaa28a2b37aaf4579298d
-
SHA256
7fedce2ae560ffae57875276f35e2a207a6c784a011f7a69b8c24fe72486608a
-
SHA512
897d8199e5493aa179f52e53aa21fa2ca1b30ccf0d7ae1024ae2cc27a5f95f98faa11abc22c12ac08907706741c98f8376a5f81aabf8e4e1781f46209b6e627f
-
SSDEEP
3072:8Y+NI7kRiwdkWXoktrSAevemKzr6z3ZIQQ7WMat7Cv:0fi8rXvHUKq3i77k
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\apdqnxp = "{708855BA-D2B2-49FE-A723-4C2389F688EF}" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708855BA-D2B2-49FE-A723-4C2389F688EF}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708855BA-D2B2-49FE-A723-4C2389F688EF} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{708855BA-D2B2-49FE-A723-4C2389F688EF}\InProcServer32\ = "C:\\Windows\\apdqnxp.dll" rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2112 2716 rundll32.exe 30 PID 2716 wrote to memory of 2112 2716 rundll32.exe 30 PID 2716 wrote to memory of 2112 2716 rundll32.exe 30 PID 2716 wrote to memory of 2112 2716 rundll32.exe 30 PID 2716 wrote to memory of 2112 2716 rundll32.exe 30 PID 2716 wrote to memory of 2112 2716 rundll32.exe 30 PID 2716 wrote to memory of 2112 2716 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2112
-