Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e5832d3238da12d21f60a2b8e736594ff758c6d1ea3d9f63841fa0d6825743f3.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_e5832d3238da12d21f60a2b8e736594ff758c6d1ea3d9f63841fa0d6825743f3.dll
-
Size
626KB
-
MD5
1d1b6cbf522cacca5aad0ebd6488c9be
-
SHA1
6da74b64f56c38e245d662ec00ba66057e978a67
-
SHA256
e5832d3238da12d21f60a2b8e736594ff758c6d1ea3d9f63841fa0d6825743f3
-
SHA512
60f57c2e0d110c550a0561d28bf1cc0b5a2957cd685acb7604452fcd06e7afef605766adfa023699dec73395b4ca8e8f9683d604ceed04ccad5cbfababef6852
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8Za:+w1lEKOpuYxiwkkgjAN8Za
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 16 3196 rundll32.exe 30 3196 rundll32.exe 50 3196 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4044 wrote to memory of 3196 4044 rundll32.exe 84 PID 4044 wrote to memory of 3196 4044 rundll32.exe 84 PID 4044 wrote to memory of 3196 4044 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5832d3238da12d21f60a2b8e736594ff758c6d1ea3d9f63841fa0d6825743f3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5832d3238da12d21f60a2b8e736594ff758c6d1ea3d9f63841fa0d6825743f3.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:3196
-