Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/01/2025, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_15e36bd456614d428561b38e87aba07c.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_15e36bd456614d428561b38e87aba07c.dll
-
Size
72KB
-
MD5
15e36bd456614d428561b38e87aba07c
-
SHA1
e7c2d9feb0c45541c6ae6cb18b90ef0f29a7b26b
-
SHA256
08f4a49c74800f7dea3b56a658ebb9f52c70b458092bceca590e451903b79d4c
-
SHA512
5e7dbbc19427d21a174adc7f88af01efa48a45c57ab82348d34e0aea4b162bd49c1bacdb334b6013ce3e5ddd912f5dcb97b19de2cafe94e7924983df50e7192d
-
SSDEEP
1536:RVxdUP/wTxO/CLrlz7yNAf3jue7Dfj7kujJqb539EXFFQvkbg5pRDi6:RV4ndw7B/j7nb7kqobR9CCvkbyDi
Malware Config
Signatures
-
Pony family
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/1252-5-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1252-6-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1252-15-0x0000000000400000-0x000000000042B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1252 rundll32.exe Token: SeTcbPrivilege 1252 rundll32.exe Token: SeChangeNotifyPrivilege 1252 rundll32.exe Token: SeCreateTokenPrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeIncreaseQuotaPrivilege 1252 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 1252 rundll32.exe Token: SeImpersonatePrivilege 1252 rundll32.exe Token: SeTcbPrivilege 1252 rundll32.exe Token: SeChangeNotifyPrivilege 1252 rundll32.exe Token: SeCreateTokenPrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeIncreaseQuotaPrivilege 1252 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 1252 rundll32.exe Token: SeImpersonatePrivilege 1252 rundll32.exe Token: SeTcbPrivilege 1252 rundll32.exe Token: SeChangeNotifyPrivilege 1252 rundll32.exe Token: SeCreateTokenPrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeIncreaseQuotaPrivilege 1252 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 1252 rundll32.exe Token: SeImpersonatePrivilege 1252 rundll32.exe Token: SeTcbPrivilege 1252 rundll32.exe Token: SeChangeNotifyPrivilege 1252 rundll32.exe Token: SeCreateTokenPrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeIncreaseQuotaPrivilege 1252 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 1252 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1252 2156 rundll32.exe 30 PID 2156 wrote to memory of 1252 2156 rundll32.exe 30 PID 2156 wrote to memory of 1252 2156 rundll32.exe 30 PID 2156 wrote to memory of 1252 2156 rundll32.exe 30 PID 2156 wrote to memory of 1252 2156 rundll32.exe 30 PID 2156 wrote to memory of 1252 2156 rundll32.exe 30 PID 2156 wrote to memory of 1252 2156 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15e36bd456614d428561b38e87aba07c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15e36bd456614d428561b38e87aba07c.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1252
-