Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 03:03

General

  • Target

    JaffaCakes118_09c4c8f3185971c33b5c3031ca295e07.pdf

  • Size

    13KB

  • MD5

    09c4c8f3185971c33b5c3031ca295e07

  • SHA1

    a2c36931766755a768be2fdec3ed698ed7ffc551

  • SHA256

    13b5e66ff836372df8ef9318cf7e1cc498e535c7ce35e96f1076819c9061d31b

  • SHA512

    74f102a807dc759182d9e5c501913ce9ff2f577ccd34052ee8bb264406a14ad2035e1d3e3ca59af46c612845c4271d3d5987aa93ea0b7d096d879283032d54e4

  • SSDEEP

    384:shzaNwAO9GiM5fdtttrRQi/60G78s4djN:khZGiM5fdtttlQC6d8si

Malware Config

Extracted

Family

latentbot

C2

ratbiiqbtal.zapto.org

Signatures

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_09c4c8f3185971c33b5c3031ca295e07.pdf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2412-0-0x00000000030B0000-0x0000000003126000-memory.dmp

    Filesize

    472KB

  • memory/2412-3-0x00000000010A0000-0x00000000010A1000-memory.dmp

    Filesize

    4KB