Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e.dll
-
Size
416KB
-
MD5
f2fc087a47acfd5626ed803964bbac1e
-
SHA1
28ad64741a5eb419b381f185794a73007da681cd
-
SHA256
2a21fc6416ca10a6c165742a5c230220da02574bfd912e269a0297eddecf70de
-
SHA512
4ebd6fa084a110621818e7ce713aab0518a9e362bdd928e16865a2d5a929cf1b5da1298d3eec8286bccac00b8ea2a57fe597afa32aa75445a61bf38e286ea593
-
SSDEEP
12288:3ip2ukggSkVR0tIMM1pbKKQ48Iqgt8rXVdAg:SpuDSO0tW1pbKKQ4pqgt8rwg
Malware Config
Signatures
-
Pony family
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral2/memory/1776-36-0x0000000000BE0000-0x0000000000BF6000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4424 wrote to memory of 1776 4424 rundll32.exe 83 PID 4424 wrote to memory of 1776 4424 rundll32.exe 83 PID 4424 wrote to memory of 1776 4424 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f2fc087a47acfd5626ed803964bbac1e.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1776
-