Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0.dll
-
Size
626KB
-
MD5
9383eb5aff015ec459bc1dbe0ee225d3
-
SHA1
b8d87586a86ff604027d1a981b9b3c83b139051f
-
SHA256
86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0
-
SHA512
6dbe6ad2fbcc06790ca66bdd99b1a58cbe60f8ad4311db70f415e89eab08ddf0b12ed3d1cc89fb1096691f462562939fd80cea333329c21928ca3d1dedfc57fb
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Z5j:+w1lEKOpuYxiwkkgjAN8Z5j
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 4 2536 rundll32.exe 6 2536 rundll32.exe 9 2536 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1156 wrote to memory of 2536 1156 rundll32.exe 30 PID 1156 wrote to memory of 2536 1156 rundll32.exe 30 PID 1156 wrote to memory of 2536 1156 rundll32.exe 30 PID 1156 wrote to memory of 2536 1156 rundll32.exe 30 PID 1156 wrote to memory of 2536 1156 rundll32.exe 30 PID 1156 wrote to memory of 2536 1156 rundll32.exe 30 PID 1156 wrote to memory of 2536 1156 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_86d61aa4ed1d997bc054eba24fb08ea84d174174547f3fa0eac827e752c02ff0.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2536
-