Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 21:03
Behavioral task
behavioral1
Sample
JaffaCakes118_ac7bc6e704cdb832a57d51742987a004.dll
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_ac7bc6e704cdb832a57d51742987a004.dll
-
Size
1.3MB
-
MD5
ac7bc6e704cdb832a57d51742987a004
-
SHA1
8fc475edf46bbf9ec227710fcf863133f4242565
-
SHA256
1f24c8a4137a82bdf5b6b9b0204835d980f636b5bd0348567a0855ef928a415f
-
SHA512
7a2009f5c4d44edefd1cd43005a29cbbb50b3155c87320273ff4b0ede4d7a6845dcbb0837ba84f4fd268412aad7315e4bab52405a451abc3cc266e091bae8119
-
SSDEEP
24576:8cF2+Jin5TSNKAlP4OXzCSVwInBTPV105:/sOXzPVnT
Malware Config
Extracted
danabot
4
5.9.224.204:443
192.210.222.81:443
23.229.29.48:443
-
embedded_hash
0E1A7A1479C37094441FA911262B322A
-
type
loader
Signatures
-
Danabot Loader Component 15 IoCs
resource yara_rule behavioral1/memory/2756-0-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-1-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-2-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-3-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-4-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-5-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-6-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-7-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-8-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-9-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-10-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-11-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-12-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-13-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 behavioral1/memory/2756-14-0x00000000007C0000-0x0000000000921000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2756 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2756 2680 rundll32.exe 30 PID 2680 wrote to memory of 2756 2680 rundll32.exe 30 PID 2680 wrote to memory of 2756 2680 rundll32.exe 30 PID 2680 wrote to memory of 2756 2680 rundll32.exe 30 PID 2680 wrote to memory of 2756 2680 rundll32.exe 30 PID 2680 wrote to memory of 2756 2680 rundll32.exe 30 PID 2680 wrote to memory of 2756 2680 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac7bc6e704cdb832a57d51742987a004.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ac7bc6e704cdb832a57d51742987a004.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2756
-