Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
09/01/2025, 21:32
250109-1dpr9a1rc1 1004/12/2024, 03:12
241204-dqgwvaypcy 1003/12/2024, 21:44
241203-1lvy8swjgv 1025/09/2024, 06:02
240925-grgh9asblg 10Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
-
Size
422KB
-
MD5
f55920966b4970588ce643af0fcc03a7
-
SHA1
97c44c58f24358442cb1811a7694e5b395e82d61
-
SHA256
0d533321292f6854d7f9705a738d58ee5941c93b52674681083ec5c21a987ab1
-
SHA512
b5e6f91e65eacd6c1ad5f563f0d9184fd21fb88848008c7ea568d7c40c63fcbf217eeee2830a521313a3152e538821a469630fe951e760405972afae8516023e
-
SSDEEP
12288:yClc4hq+Ytl63+YzGKBTpJHtvgqYe7S9S:Tlc4kBl6OabpFtGgS0
Malware Config
Extracted
zloader
-
build_id
49
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Edhuoh = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Fadeu\\ugehocuc.dll,DllRegisterServer" msiexec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 40 2216 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3740 set thread context of 2216 3740 rundll32.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 2216 msiexec.exe Token: SeSecurityPrivilege 2216 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4664 wrote to memory of 3740 4664 rundll32.exe 82 PID 4664 wrote to memory of 3740 4664 rundll32.exe 82 PID 4664 wrote to memory of 3740 4664 rundll32.exe 82 PID 3740 wrote to memory of 2216 3740 rundll32.exe 92 PID 3740 wrote to memory of 2216 3740 rundll32.exe 92 PID 3740 wrote to memory of 2216 3740 rundll32.exe 92 PID 3740 wrote to memory of 2216 3740 rundll32.exe 92 PID 3740 wrote to memory of 2216 3740 rundll32.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-