Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/01/2025, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll
-
Size
2.5MB
-
MD5
de8b54a938ac18f15cad804d79a0e19d
-
SHA1
b6004c62e2d9dbad9cfd5f7e18647ac983788766
-
SHA256
2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd
-
SHA512
7b64a99baafc8e692a47b9856f96b6bafa3cae22bd293c0e8faf148bdfe3f1401d5c316017b5c2f778d02ebc87edd2474e525b225ddc00685bb14da4c484e776
-
SSDEEP
49152:ZgZziYTt//YDt2Z/fZMdzUAOC5n+LlrxFTGWgKq:Z0ziYTKh2Z/f6AAOGarxFTG/v
Malware Config
Extracted
danabot
40
185.158.250.216:443
194.76.225.46:443
45.11.180.153:443
194.76.225.61:443
-
embedded_hash
AD14EA44261341E3690FA8CC1E236523
-
type
loader
Signatures
-
Danabot Loader Component 17 IoCs
resource yara_rule behavioral1/memory/2552-2-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-3-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-7-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-8-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-9-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-10-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-11-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-12-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-13-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-14-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-15-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-16-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-17-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-18-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-19-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-20-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 behavioral1/memory/2552-21-0x00000000740E0000-0x000000007436E000-memory.dmp DanabotLoader2021 -
Danabot family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2552 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2552 2184 rundll32.exe 30 PID 2184 wrote to memory of 2552 2184 rundll32.exe 30 PID 2184 wrote to memory of 2552 2184 rundll32.exe 30 PID 2184 wrote to memory of 2552 2184 rundll32.exe 30 PID 2184 wrote to memory of 2552 2184 rundll32.exe 30 PID 2184 wrote to memory of 2552 2184 rundll32.exe 30 PID 2184 wrote to memory of 2552 2184 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de8b54a938ac18f15cad804d79a0e19d.dll,#12⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2552
-