Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 23:31
Behavioral task
behavioral1
Sample
ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
General
-
Target
ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll
-
Size
112KB
-
MD5
ff801df30c4e5a90ce36d2f65c996f50
-
SHA1
3177e672eb6b391b8c3ee3f66d3e44473aedb5b4
-
SHA256
113274f68b8b4ab28793d9e85f54d1260a2d51dbcfacb0a27767415b0603a3d2
-
SHA512
00098fb3caa9d6c268aa759ef40c1e6458bd9e0ef5b4f821626703d95db80be9c7c10b1ec03747dabc94c13c64c1d9d3fd524c0bed39a03b39b4b6b0642ff78e
-
SSDEEP
3072:g81m+O6rM/TWeHiYz3hLTIhttHU4o4ugkCiHWwx:l1TMvCYVLTIT64N1kJ2W
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c00000002346b-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 2276 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Iefg\Nefghijkl.pic rundll32.exe File created C:\Program Files (x86)\Iefg\Nefghijkl.pic rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe 2276 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2232 rundll32.exe Token: SeRestorePrivilege 2232 rundll32.exe Token: SeBackupPrivilege 2232 rundll32.exe Token: SeRestorePrivilege 2232 rundll32.exe Token: SeBackupPrivilege 2232 rundll32.exe Token: SeRestorePrivilege 2232 rundll32.exe Token: SeBackupPrivilege 2232 rundll32.exe Token: SeRestorePrivilege 2232 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2232 1072 rundll32.exe 82 PID 1072 wrote to memory of 2232 1072 rundll32.exe 82 PID 1072 wrote to memory of 2232 1072 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff801df30c4e5a90ce36d2f65c996f50_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD5361f7d1680bb8cae9f705c7c3c090b33
SHA145da9c72e21fd5d1d1b621da0cc6c022157f905f
SHA25698d32d3d724c9d026785608e2d1be4439cbabdef34e15c6d1f144da2d980243f
SHA5120e08b2bfffdaae5b2aa07a422fc3c686796268d53e8ef385c3ba1c89895566abf0f34257c9db9636e8740be1224d45462b765e0d5db42149fb2d98d78c38dc24