Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 06:49
Behavioral task
behavioral1
Sample
JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe
-
Size
110KB
-
MD5
3cfa0e6866f2919907781cdc7a7133e9
-
SHA1
163c138189596f4b8053c341283cb382732cbec8
-
SHA256
dfe9db1da244e566f45050b88078763e5e39ecd3a4496bbc717629da04fbfc8a
-
SHA512
8362b917813c030be94e2e45c2a87e89ae9c41102b8fe0d6090af7395319a97e0914d9beb551c2879791d08329c53258b1b1703dbd1aff7657aea166ac796b98
-
SSDEEP
3072:8EXI1SyGRjgp1gl5IRXlmAUW5NiWEHaTAwTw+spbxY1:JX0SyGRjgpCl5IRXEAZ30HQPw+a2
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x000000000041CE38-memory.dmp family_gh0strat behavioral2/files/0x000c000000023b35-4.dat family_gh0strat behavioral2/memory/4540-7-0x0000000010000000-0x000000001001A000-memory.dmp family_gh0strat behavioral2/memory/4808-6-0x0000000000400000-0x000000000041CE38-memory.dmp family_gh0strat behavioral2/memory/4540-8-0x0000000010000000-0x000000001001A000-memory.dmp family_gh0strat -
Gh0strat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility360.dll" JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe -
Loads dropped DLL 1 IoCs
pid Process 4540 SVCHOST.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility360.dll JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 4624 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4624 taskkill.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4624 4808 JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe 83 PID 4808 wrote to memory of 4624 4808 JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe 83 PID 4808 wrote to memory of 4624 4808 JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3cfa0e6866f2919907781cdc7a7133e9.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im RSTray.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Windows\SysWOW64\SVCHOST.EXEC:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5f7b927ed1fb3547f518d0c065dd70ed9
SHA15090d2e5274f3696779dce4f21544b4492520cd9
SHA2567f914a1871084feac50efda43bbbd77bc70747303e2fe01b8d48959136d0644d
SHA512a8bac9fc3d692cf911e9ea22993dfd147eb8b7afb9986d9ee9c7bd1e4b4728d7c72be27bebb889ac75576e8deecef87f521d0340391f857ce4a75646f7af9d35