Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2025, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll
-
Size
1.2MB
-
MD5
ecc7a0be227c3d328eccc7e1cdb4ac81
-
SHA1
8fb05510b29d1a57f933db6d1a999ab9a3f8b7a2
-
SHA256
fc787358c9d9f5af8af3ca17cdbf8760bbf786d57b1ca9f6b0034bd1070cf6ec
-
SHA512
ff49eaeae984b0a264b222b517c8c7530fc4caed785e22874ecd53857d1db7fcb241e6920129af7d50ce197094c8b8310b69f1a5c659594310e938ab136d6255
-
SSDEEP
24576:mw7BZFodRlyc501VWUMkTjACzDSQPhy5DipHl950JkSr+qk5acKVv8dTF+7:9Lt18UMeTzDjpbpr50mSrtkIcKVvuB+7
Malware Config
Extracted
qakbot
402.363
tr
1633943125
140.82.49.12:443
89.137.52.44:443
24.107.165.50:443
66.216.193.114:443
75.131.217.182:443
41.86.42.158:995
24.119.214.7:443
67.166.233.75:443
105.198.236.99:443
120.151.47.189:443
2.222.167.138:443
41.228.22.180:443
78.105.213.151:995
5.193.125.67:995
41.86.42.158:443
96.57.188.174:2078
120.150.218.241:995
66.177.215.152:0
122.11.220.212:2222
73.52.50.32:443
63.143.92.99:995
103.142.10.177:443
81.241.252.59:2078
167.248.117.81:443
220.255.25.28:2222
81.213.59.22:443
197.90.242.92:61201
197.89.144.3:443
103.148.120.144:443
181.118.183.94:443
94.200.181.154:443
209.236.35.178:443
67.230.44.194:443
188.50.52.75:995
72.173.78.211:443
93.48.58.123:2222
81.250.153.227:2222
185.250.148.74:443
73.77.87.137:443
84.39.192.102:995
85.109.229.54:995
174.54.193.186:443
136.232.34.70:443
77.31.162.93:443
76.25.142.196:443
39.33.165.65:995
37.210.152.224:995
73.151.236.31:443
173.21.10.71:2222
186.32.163.199:443
73.230.205.91:443
71.74.12.34:443
75.188.35.168:443
181.4.53.6:465
89.101.97.139:443
68.204.7.158:443
45.46.53.140:2222
109.12.111.14:443
203.213.107.174:443
200.232.214.222:995
73.77.87.137:995
47.40.196.233:2222
86.8.177.143:443
67.165.206.193:993
216.201.162.158:443
199.27.127.129:443
209.50.20.255:443
72.27.211.245:995
77.57.204.78:443
27.223.92.142:995
99.227.243.24:993
187.250.159.104:443
187.172.230.218:443
69.30.186.190:443
177.94.34.42:995
24.139.72.117:443
24.229.150.54:995
177.170.201.134:995
72.252.201.69:443
47.22.148.6:443
98.157.235.126:443
124.123.42.115:2222
2.99.100.134:2222
182.176.180.73:443
80.6.192.58:443
40.131.140.155:995
162.244.227.34:443
110.174.64.179:995
202.134.178.157:443
189.136.217.97:995
24.55.112.61:443
66.103.170.104:2222
209.142.97.161:995
74.72.237.54:443
66.177.215.152:50010
131.191.107.34:995
75.75.179.226:443
24.171.50.5:443
49.33.237.65:443
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
189.131.221.201:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
177.94.125.59:995
73.130.180.25:443
217.17.56.163:2078
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
143.131.13.161:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Pwoxde = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Fifzzunyur = "0" reg.exe -
Loads dropped DLL 1 IoCs
pid Process 1004 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\aec75859 = 55c1dc8fe72b0875dd9c75389d669e156725afe6e3a7d7da58478b03e6cd34360dcc4a545bf4a2a3cf0ea776e455b7d6c4484118a804c4c013b405cb6c68c26323265a98478d60d0b4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\ac867825 = 47b25383702de742528e66dccafa16267db9f248eebc800f070de69913e84e00443b49af83a437bb96a1ad6a1f3fccd35137127c1b explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\5eeca0f8 = cb5437dcc226e7194ae414db568fe1a3eaf42174b782d3a93990c5123b75676c93af7cfe303b1772ef2ec0a7e56596a7e9b41232455ca7c10ea04e2ee574b569f432255d9182668925fdab8da657a4debf503144f4785bfcf638d4 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\167b3f3c = d299144f40904701fd450562ff1b66f6be1d9c9711d3fe8ad0fa50c4ea72e130cb3799b24aad22cddb801c55004a1ac30850959a7f39796c428164c51e746408ca16ac06f681a73a4f19d24e6dc51a83cb509f7ecac20f explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\d3cf17d3 = 432267d2b300dbe40b0250268c4ae60006a7f2f8e931c5a361a98d3ee64d3e7010120285db623ce06e6e3596957213e8f5a14a2ad3626e926d4f3e3665286d5f4a466cb2729f9274bb0238 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\6b7370b6 = 7ab1f25e035edfd40d5bfbb8f1c7165d6163a1eb24b825cf5f1a1d5fad69811eda1dfc048e38e0d983a97d535967f0795abaff5810c688641d4c02d41c11bc14ec04a618ea1e9d321c4b82 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\21a5cf0e = 10913f562fb8d39741f1e8319535d284775d80c5faf56c88eecd6560f742e5ed8b25b951fc224cd329023451c1d3d110e8c22208d3b35b5c6f7b2aa79cd0d1efec50fb6bbf2d3d84e42ccd89e30ba5f0a7e63f6e7492d6e7 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\21a5cf0e = 109128562fb8e60d3c523dec35125e724987aae95d51367c66b3dc89a2e5f23395b3c88ecb121bedd5feff3564e97b81bb7afd40dcca5b3f8d3c79b76d24fb20e9933c explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Dhamhhylyd\143a1f40 = 23d03be6e36c5d5ade9b94f2f61e4b66c0f02d607922b749cd0b6d11e8c8f9a71fc6ba2c809cdf4d704862b91aa6516d9b02cccaf3882c38d02b9d2c5b89ee1d46f0dfc09060f5ed529e994a0a13779e70aedd756daa2c1fb1d4d6c08dd6debe0e183e5a1a4dfc60f2a6c4268f15b6e19a5a669707d5d8355eb42a5e518b8afc2ba6946d67a0d08821d12d8e8dd6d049ac53d5 explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2412 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1184 rundll32.exe 1184 rundll32.exe 1004 regsvr32.exe 1004 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1184 rundll32.exe 1004 regsvr32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4544 wrote to memory of 1184 4544 rundll32.exe 83 PID 4544 wrote to memory of 1184 4544 rundll32.exe 83 PID 4544 wrote to memory of 1184 4544 rundll32.exe 83 PID 1184 wrote to memory of 2684 1184 rundll32.exe 91 PID 1184 wrote to memory of 2684 1184 rundll32.exe 91 PID 1184 wrote to memory of 2684 1184 rundll32.exe 91 PID 1184 wrote to memory of 2684 1184 rundll32.exe 91 PID 1184 wrote to memory of 2684 1184 rundll32.exe 91 PID 2684 wrote to memory of 2412 2684 explorer.exe 92 PID 2684 wrote to memory of 2412 2684 explorer.exe 92 PID 2684 wrote to memory of 2412 2684 explorer.exe 92 PID 1832 wrote to memory of 1004 1832 regsvr32.exe 104 PID 1832 wrote to memory of 1004 1832 regsvr32.exe 104 PID 1832 wrote to memory of 1004 1832 regsvr32.exe 104 PID 1004 wrote to memory of 372 1004 regsvr32.exe 105 PID 1004 wrote to memory of 372 1004 regsvr32.exe 105 PID 1004 wrote to memory of 372 1004 regsvr32.exe 105 PID 1004 wrote to memory of 372 1004 regsvr32.exe 105 PID 1004 wrote to memory of 372 1004 regsvr32.exe 105 PID 372 wrote to memory of 4228 372 explorer.exe 106 PID 372 wrote to memory of 4228 372 explorer.exe 106 PID 372 wrote to memory of 4720 372 explorer.exe 108 PID 372 wrote to memory of 4720 372 explorer.exe 108
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pnbtorwl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll\"" /SC ONCE /Z /ST 19:57 /ET 20:094⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2412
-
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ecc7a0be227c3d328eccc7e1cdb4ac81.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Fifzzunyur" /d "0"4⤵
- Windows security bypass
PID:4228
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Pwoxde" /d "0"4⤵
- Windows security bypass
PID:4720
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5ecc7a0be227c3d328eccc7e1cdb4ac81
SHA18fb05510b29d1a57f933db6d1a999ab9a3f8b7a2
SHA256fc787358c9d9f5af8af3ca17cdbf8760bbf786d57b1ca9f6b0034bd1070cf6ec
SHA512ff49eaeae984b0a264b222b517c8c7530fc4caed785e22874ecd53857d1db7fcb241e6920129af7d50ce197094c8b8310b69f1a5c659594310e938ab136d6255