Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_500068f35b3db2b2ae4e28cfbe7348b0f309f97bcd2fbadb7ac190266be43624.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_500068f35b3db2b2ae4e28cfbe7348b0f309f97bcd2fbadb7ac190266be43624.dll
-
Size
624KB
-
MD5
470e12e29f5a8a82c1e61d87f34e28f3
-
SHA1
7dd577a8e670b7d2a732f52eca5d4185eba796ff
-
SHA256
500068f35b3db2b2ae4e28cfbe7348b0f309f97bcd2fbadb7ac190266be43624
-
SHA512
5f4ccbe68a885ff6212b91316a7dd3cf8bb89d1873525f08e9804be94596367a8cb09868bb4b4b525515b5018e4ab96356865a9db9e3478f160b07cb1e86abf2
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZU:+w1lEKOpuYxiwkkgjAN8ZU
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2644 3048 rundll32.exe 30 PID 3048 wrote to memory of 2644 3048 rundll32.exe 30 PID 3048 wrote to memory of 2644 3048 rundll32.exe 30 PID 3048 wrote to memory of 2644 3048 rundll32.exe 30 PID 3048 wrote to memory of 2644 3048 rundll32.exe 30 PID 3048 wrote to memory of 2644 3048 rundll32.exe 30 PID 3048 wrote to memory of 2644 3048 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500068f35b3db2b2ae4e28cfbe7348b0f309f97bcd2fbadb7ac190266be43624.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_500068f35b3db2b2ae4e28cfbe7348b0f309f97bcd2fbadb7ac190266be43624.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2644
-