Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f3104f00c64cce223745c47a1389e0e79dc27ce9aae414ce0b70757200a1b788.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f3104f00c64cce223745c47a1389e0e79dc27ce9aae414ce0b70757200a1b788.dll
-
Size
2.2MB
-
MD5
f352cd23cf3c164a64941438b5b799f4
-
SHA1
7bfcb960c88387762f18e53336e49e593652e54d
-
SHA256
f3104f00c64cce223745c47a1389e0e79dc27ce9aae414ce0b70757200a1b788
-
SHA512
98ff68562a7c1b113cab1096124d6f0f036f07137282c54834b20bbe2469c37cfa1a2644a5819e6205ff2d673e56fd04a5aeaf26acba12d45231a6e7128c2586
-
SSDEEP
6144:Zo0gTwr/cG3J8Wt/s1XGxfSCkq/vWc3Wh0lxPIerqJg:ZoidiofSth
Malware Config
Extracted
trickbot
100021
rob142
181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443
- autorun
Signatures
-
Trickbot family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2524 wermgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 1984 wrote to memory of 2100 1984 rundll32.exe 30 PID 2100 wrote to memory of 2312 2100 rundll32.exe 31 PID 2100 wrote to memory of 2312 2100 rundll32.exe 31 PID 2100 wrote to memory of 2312 2100 rundll32.exe 31 PID 2100 wrote to memory of 2312 2100 rundll32.exe 31 PID 2100 wrote to memory of 2524 2100 rundll32.exe 32 PID 2100 wrote to memory of 2524 2100 rundll32.exe 32 PID 2100 wrote to memory of 2524 2100 rundll32.exe 32 PID 2100 wrote to memory of 2524 2100 rundll32.exe 32 PID 2100 wrote to memory of 2524 2100 rundll32.exe 32 PID 2100 wrote to memory of 2524 2100 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3104f00c64cce223745c47a1389e0e79dc27ce9aae414ce0b70757200a1b788.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3104f00c64cce223745c47a1389e0e79dc27ce9aae414ce0b70757200a1b788.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵PID:2312
-
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-