Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/01/2025, 03:44
Behavioral task
behavioral1
Sample
JaffaCakes118_da1245c8c145fb622b9d5b5c9d6eb25f.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_da1245c8c145fb622b9d5b5c9d6eb25f.dll
-
Size
1.3MB
-
MD5
da1245c8c145fb622b9d5b5c9d6eb25f
-
SHA1
434cc1b89eb61113b0218eea6aef41a03d5250ae
-
SHA256
109d560d0a9e215237dfc637ecb70c537cf054318a442e0eb996d52dc5cc046c
-
SHA512
5394115c24527d9a0a02cdc58bc000f104497d9185881a2086529e0028daf8b038779749fe381066f3dbcf84360fbfd3917faee5d19e6f8c24bdc06c78c91775
-
SSDEEP
24576:58FG/L98qXKTVfl8B0Y1ewAfj3xCV2D3qyzdTrQB79t:a7VSNAfj3xCoayzdT0j
Malware Config
Extracted
danabot
4
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
-
embedded_hash
F4711E27D559B4AEB1A081A1EB0AC465
-
type
loader
Signatures
-
Danabot Loader Component 2 IoCs
resource yara_rule behavioral1/memory/2356-0-0x0000000001E30000-0x0000000001F90000-memory.dmp DanabotLoader2021 behavioral1/memory/2356-1-0x0000000001E30000-0x0000000001F90000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 1 2356 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2356 2532 rundll32.exe 30 PID 2532 wrote to memory of 2356 2532 rundll32.exe 30 PID 2532 wrote to memory of 2356 2532 rundll32.exe 30 PID 2532 wrote to memory of 2356 2532 rundll32.exe 30 PID 2532 wrote to memory of 2356 2532 rundll32.exe 30 PID 2532 wrote to memory of 2356 2532 rundll32.exe 30 PID 2532 wrote to memory of 2356 2532 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_da1245c8c145fb622b9d5b5c9d6eb25f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_da1245c8c145fb622b9d5b5c9d6eb25f.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2356
-