Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
fe7630320000e354032c18fdae16af21_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe7630320000e354032c18fdae16af21_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fe7630320000e354032c18fdae16af21_JaffaCakes118.dll
-
Size
52KB
-
MD5
fe7630320000e354032c18fdae16af21
-
SHA1
c30062910c38ac924dd093cc57814d1ed987da48
-
SHA256
298373492d1c069be7dc17748bd85b61d7292dc01d7744b8eb10fae087a5c66d
-
SHA512
4a781a9d8beb63649236f5ed546e7bc6898d3d25428dc55d885d56426651246dfd2af9b1c26b8677b335cbd474bd7ff27db913a7ffb0c3b876556236e2961fb1
-
SSDEEP
1536:a3idBevKuP4LCb/YiLZY9My7ye6Us9F9En:aydBeCubb/YiWZ7yeTs7+n
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/5040-4-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral2/memory/3952-5-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral2/memory/5040-9-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat behavioral2/memory/3952-10-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 3952 rundll32.exe 45 3952 rundll32.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fe7630320000e354032c18fdae16af21_JaffaCakes118.dll" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5040 svchost.exe Token: SeDebugPrivilege 3952 rundll32.exe Token: SeDebugPrivilege 3952 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3664 wrote to memory of 3088 3664 rundll32.exe 82 PID 3664 wrote to memory of 3088 3664 rundll32.exe 82 PID 3664 wrote to memory of 3088 3664 rundll32.exe 82 PID 5040 wrote to memory of 3952 5040 svchost.exe 84 PID 5040 wrote to memory of 3952 5040 svchost.exe 84 PID 5040 wrote to memory of 3952 5040 svchost.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7630320000e354032c18fdae16af21_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe7630320000e354032c18fdae16af21_JaffaCakes118.dll,#12⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
PID:3088
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe c:\users\admin\appdata\local\temp\fe7630320000e354032c18fdae16af21_jaffacakes118.dll wintest2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3952
-