Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 13:16
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_3fed81a6cbd359ad4abf4f4514c9ea2d.dll
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_3fed81a6cbd359ad4abf4f4514c9ea2d.dll
-
Size
68KB
-
MD5
3fed81a6cbd359ad4abf4f4514c9ea2d
-
SHA1
a98f373d81fb1a3706f084f018349c27b0ab910e
-
SHA256
e3bb81bdc1c947c9047426fd8c15a700fa2559cfc51da731ea253f5d14d18c81
-
SHA512
bf77940449b2a760c17309f2f0d6b1c363b05c384bf94530317be5619851145990bb3595fcb7f3f95186a3b4f79edaf73499e29ce3872ab85b9eb379cf3c78ca
-
SSDEEP
1536:sa240tDy6bwZsgejxxSIYVeLbmHzT8DvuE2xx0VaoNK2eMADfgr/Xr:saazbw+gSx0IYkw38zE0VaoNtlI+/7
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4928-2-0x0000000010000000-0x000000001003A000-memory.dmp family_gh0strat behavioral2/memory/4928-3-0x0000000010000000-0x000000001003A000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4928 4860 rundll32.exe 85 PID 4860 wrote to memory of 4928 4860 rundll32.exe 85 PID 4860 wrote to memory of 4928 4860 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fed81a6cbd359ad4abf4f4514c9ea2d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fed81a6cbd359ad4abf4f4514c9ea2d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4928
-