Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 23:31
Behavioral task
behavioral1
Sample
ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
General
-
Target
ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll
-
Size
112KB
-
MD5
ff801df30c4e5a90ce36d2f65c996f50
-
SHA1
3177e672eb6b391b8c3ee3f66d3e44473aedb5b4
-
SHA256
113274f68b8b4ab28793d9e85f54d1260a2d51dbcfacb0a27767415b0603a3d2
-
SHA512
00098fb3caa9d6c268aa759ef40c1e6458bd9e0ef5b4f821626703d95db80be9c7c10b1ec03747dabc94c13c64c1d9d3fd524c0bed39a03b39b4b6b0642ff78e
-
SSDEEP
3072:g81m+O6rM/TWeHiYz3hLTIhttHU4o4ugkCiHWwx:l1TMvCYVLTIT64N1kJ2W
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c0000000173c2-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 2156 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Iefg\Nefghijkl.pic rundll32.exe File opened for modification C:\Program Files (x86)\Iefg\Nefghijkl.pic rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe 2156 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2068 rundll32.exe Token: SeRestorePrivilege 2068 rundll32.exe Token: SeBackupPrivilege 2068 rundll32.exe Token: SeRestorePrivilege 2068 rundll32.exe Token: SeBackupPrivilege 2068 rundll32.exe Token: SeRestorePrivilege 2068 rundll32.exe Token: SeBackupPrivilege 2068 rundll32.exe Token: SeRestorePrivilege 2068 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2068 3004 rundll32.exe 30 PID 3004 wrote to memory of 2068 3004 rundll32.exe 30 PID 3004 wrote to memory of 2068 3004 rundll32.exe 30 PID 3004 wrote to memory of 2068 3004 rundll32.exe 30 PID 3004 wrote to memory of 2068 3004 rundll32.exe 30 PID 3004 wrote to memory of 2068 3004 rundll32.exe 30 PID 3004 wrote to memory of 2068 3004 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5ab90587eb1dfb2aa54bfc2c6a142cba8
SHA18dc1ab6427efdd26efa612b53d00ab98a66472da
SHA256e0e047aab5e63bf67e3b41becdc8a9901665e0dcdba54f8d6f043b42c60e7ea5
SHA512440d668b648368edb3dc0c925b8adb6053618110cb8d6468c34b1d82de6a6c890fb142e5da1982d2e713365ea1f65082ddfca455bcf29f94b60ee4a784ae4492