Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll
-
Size
196KB
-
MD5
ebd3e0e0568f541147adc9eea081801d
-
SHA1
56bbf53e5740da4a0bdcaa28a2b37aaf4579298d
-
SHA256
7fedce2ae560ffae57875276f35e2a207a6c784a011f7a69b8c24fe72486608a
-
SHA512
897d8199e5493aa179f52e53aa21fa2ca1b30ccf0d7ae1024ae2cc27a5f95f98faa11abc22c12ac08907706741c98f8376a5f81aabf8e4e1781f46209b6e627f
-
SSDEEP
3072:8Y+NI7kRiwdkWXoktrSAevemKzr6z3ZIQQ7WMat7Cv:0fi8rXvHUKq3i77k
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\apdqnxp = "{3C6E134E-06AD-4E70-89A3-0682D8C2F8A8}" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C6E134E-06AD-4E70-89A3-0682D8C2F8A8} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C6E134E-06AD-4E70-89A3-0682D8C2F8A8}\InProcServer32\ = "C:\\Windows\\apdqnxp.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C6E134E-06AD-4E70-89A3-0682D8C2F8A8}\InProcServer32 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2596 wrote to memory of 3960 2596 rundll32.exe 82 PID 2596 wrote to memory of 3960 2596 rundll32.exe 82 PID 2596 wrote to memory of 3960 2596 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebd3e0e0568f541147adc9eea081801d_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3960
-