Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
fe7630320000e354032c18fdae16af21_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe7630320000e354032c18fdae16af21_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fe7630320000e354032c18fdae16af21_JaffaCakes118.dll
-
Size
52KB
-
MD5
fe7630320000e354032c18fdae16af21
-
SHA1
c30062910c38ac924dd093cc57814d1ed987da48
-
SHA256
298373492d1c069be7dc17748bd85b61d7292dc01d7744b8eb10fae087a5c66d
-
SHA512
4a781a9d8beb63649236f5ed546e7bc6898d3d25428dc55d885d56426651246dfd2af9b1c26b8677b335cbd474bd7ff27db913a7ffb0c3b876556236e2961fb1
-
SSDEEP
1536:a3idBevKuP4LCb/YiLZY9My7ye6Us9F9En:aydBeCubb/YiWZ7yeTs7+n
Malware Config
Signatures
-
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral1/memory/2208-4-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2784-6-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2936-10-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2936-7-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2784-11-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2936-12-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2784-17-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral1/memory/2936-18-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat -
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2936 rundll32.exe 7 2936 rundll32.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe7630320000e354032c18fdae16af21_JaffaCakes118.dll" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2784 svchost.exe Token: SeDebugPrivilege 2936 rundll32.exe Token: SeDebugPrivilege 2936 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 880 wrote to memory of 2208 880 rundll32.exe 30 PID 2784 wrote to memory of 2936 2784 svchost.exe 32 PID 2784 wrote to memory of 2936 2784 svchost.exe 32 PID 2784 wrote to memory of 2936 2784 svchost.exe 32 PID 2784 wrote to memory of 2936 2784 svchost.exe 32 PID 2784 wrote to memory of 2936 2784 svchost.exe 32 PID 2784 wrote to memory of 2936 2784 svchost.exe 32 PID 2784 wrote to memory of 2936 2784 svchost.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7630320000e354032c18fdae16af21_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7630320000e354032c18fdae16af21_JaffaCakes118.dll,#12⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe c:\users\admin\appdata\local\temp\fe7630320000e354032c18fdae16af21_jaffacakes118.dll wintest2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2936
-