Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 17:20
Behavioral task
behavioral1
Sample
3b3496e812e85d90e34ade8023737fed_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
3b3496e812e85d90e34ade8023737fed_JaffaCakes118.dll
-
Size
1.4MB
-
MD5
3b3496e812e85d90e34ade8023737fed
-
SHA1
2e17dd846d2c90ee0e4574be67b13c1e1b9a3eca
-
SHA256
d06d8867e3c33eb06dcae7b633ff8f482fff412ca07e3311116dab81b9c629b0
-
SHA512
3e5fbdca678dd222489f75dd5066e852b8673106125032df772462166f344b0618ca7d7ed9f66654482bf9434aba23fd0cb94e5de5aeacf09cde8f53de198cb2
-
SSDEEP
3072:jer6rezBrn25iMt/DFGau8Ev4EuQHhZJsf++k22222222222222222222222222d:wzBr20WZGtVQxuZJsn6
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000b000000012116-3.dat family_gh0strat behavioral1/memory/1144-4-0x0000000010000000-0x0000000010023000-memory.dmp family_gh0strat -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe 1144 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1784 rundll32.exe Token: SeRestorePrivilege 1784 rundll32.exe Token: SeBackupPrivilege 1784 rundll32.exe Token: SeRestorePrivilege 1784 rundll32.exe Token: SeBackupPrivilege 1784 rundll32.exe Token: SeRestorePrivilege 1784 rundll32.exe Token: SeBackupPrivilege 1784 rundll32.exe Token: SeRestorePrivilege 1784 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1784 1632 rundll32.exe 30 PID 1632 wrote to memory of 1784 1632 rundll32.exe 30 PID 1632 wrote to memory of 1784 1632 rundll32.exe 30 PID 1632 wrote to memory of 1784 1632 rundll32.exe 30 PID 1632 wrote to memory of 1784 1632 rundll32.exe 30 PID 1632 wrote to memory of 1784 1632 rundll32.exe 30 PID 1632 wrote to memory of 1784 1632 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b3496e812e85d90e34ade8023737fed_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b3496e812e85d90e34ade8023737fed_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.2MB
MD5871d3863871bc988bdb6b9dbc42680e8
SHA122b14943f07e47e93be0c38252f2c92e8ce7269d
SHA256bc1a8865173280812a696510d828e7b25cd383df23615d91c0a66195ee0c4e80
SHA51276f80df1b2ead68e444daa3932ef2510893531770f0350f6e486c9ad3b3783c09ab6a86ab423d4e808e3dfe22d4cfee3ae8df9cbc2c87183a8ed8a052dc9ed6e
