Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
ee7bbd742172ac681be07e630bc62b06_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee7bbd742172ac681be07e630bc62b06_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ee7bbd742172ac681be07e630bc62b06_JaffaCakes118.dll
-
Size
272KB
-
MD5
ee7bbd742172ac681be07e630bc62b06
-
SHA1
7828590d7c16888ec9d97a73425d427d7fba77c9
-
SHA256
c0d77e122e1598dd2287e3924c4f19bf02cb22f559039e59029cb9d7ae01cd08
-
SHA512
4e23dcbcdea0e7bc5b49e871a361a139b9f4144e2f74956844fdf6278d16ae171b5e11c71404eb878e926c3e1927cc0476696a03237391d0c07e578a92cd675e
-
SSDEEP
3072:4+8SpRRy0d+t76qoSwu4lqw4h7Cgh4YE8A/kPlGEfVCl8kQBztD+5l/:4y0XFbTAc4GCl851q
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\bgrlsmn = "{FF4424AD-4DBF-4998-B908-1E4734D04B60}" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF4424AD-4DBF-4998-B908-1E4734D04B60} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF4424AD-4DBF-4998-B908-1E4734D04B60}\InProcServer32\ = "C:\\Windows\\bgrlsmn.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF4424AD-4DBF-4998-B908-1E4734D04B60}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3972 2908 rundll32.exe 82 PID 2908 wrote to memory of 3972 2908 rundll32.exe 82 PID 2908 wrote to memory of 3972 2908 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee7bbd742172ac681be07e630bc62b06_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee7bbd742172ac681be07e630bc62b06_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3972
-