Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_937e562bcf2ae7bd504c5cb612ae23d8d25c37236c18e80ec384aaeb121c3567.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_937e562bcf2ae7bd504c5cb612ae23d8d25c37236c18e80ec384aaeb121c3567.dll
-
Size
624KB
-
MD5
5889b9d78b80cc5bd84ed2aa1fd0c698
-
SHA1
db296b8bc43f16a18f26c8712bbd3cf7e1a80623
-
SHA256
937e562bcf2ae7bd504c5cb612ae23d8d25c37236c18e80ec384aaeb121c3567
-
SHA512
acae22635b7fd4fe15b38f1ace76b7bb14f59e385164f9bdb13c48e610d0409977e9eec0d7157c7b05ccdbfdee95ebb69bac10a5be3a4e940c2fbb461b92710b
-
SSDEEP
12288:+w1lEKREbddtOYRbHzcPwka1dCjc3N8ZW:+w1lEKOpuYxiwkkgjAN8ZW
Malware Config
Extracted
gozi
Extracted
gozi
999
config.edge.skype.com
146.70.35.138
146.70.35.142
-
base_path
/phpadmin/
-
build
250227
-
exe_type
loader
-
extension
.src
-
server_id
50
Signatures
-
Gozi family
-
Blocklisted process makes network request 4 IoCs
flow pid Process 15 2184 rundll32.exe 22 2184 rundll32.exe 44 2184 rundll32.exe 45 2184 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4876 wrote to memory of 2184 4876 rundll32.exe 82 PID 4876 wrote to memory of 2184 4876 rundll32.exe 82 PID 4876 wrote to memory of 2184 4876 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_937e562bcf2ae7bd504c5cb612ae23d8d25c37236c18e80ec384aaeb121c3567.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_937e562bcf2ae7bd504c5cb612ae23d8d25c37236c18e80ec384aaeb121c3567.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2184
-