Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
00596568a524cc376032b87762539a3c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00596568a524cc376032b87762539a3c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
00596568a524cc376032b87762539a3c_JaffaCakes118.dll
-
Size
308KB
-
MD5
00596568a524cc376032b87762539a3c
-
SHA1
819b24adb0c52e5ae80d8916ee0dcd8bf4d7cd1f
-
SHA256
6a85aa2135b3c01b40ad14f1b0bf18a20d2ae7aef41a770758ccaa2f9708e0c8
-
SHA512
c413bc15c2d6f1c557069ada9306553cd0d061f22b4bef269cc620dd69df7bb5b57f19ca65a6420adc55e828fae4b34bf0102d615a66743487bc0d34ec64163f
-
SSDEEP
6144:KKVgkqcV+ucRuedLk9KjP6BMGc+0vq5CY3WPApcfV8n1/6ajpOTBnu60AHq:skaucRuEkcjyq+bh68n1/djpOT5uyK
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\00596568a524cc376032b87762539a3c_JaffaCakes118.dll" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 2108 svchost.exe 2108 svchost.exe 2108 svchost.exe 2108 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1708 rundll32.exe Token: SeDebugPrivilege 2108 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1708 3052 rundll32.exe 31 PID 3052 wrote to memory of 1708 3052 rundll32.exe 31 PID 3052 wrote to memory of 1708 3052 rundll32.exe 31 PID 3052 wrote to memory of 1708 3052 rundll32.exe 31 PID 3052 wrote to memory of 1708 3052 rundll32.exe 31 PID 3052 wrote to memory of 1708 3052 rundll32.exe 31 PID 3052 wrote to memory of 1708 3052 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00596568a524cc376032b87762539a3c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00596568a524cc376032b87762539a3c_JaffaCakes118.dll,#12⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k mysysgroup31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108