Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2025, 17:59
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4dc2c2b6806829cdb82732e9e21283a6.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_4dc2c2b6806829cdb82732e9e21283a6.dll
-
Size
39KB
-
MD5
4dc2c2b6806829cdb82732e9e21283a6
-
SHA1
ce42a9176832187be364af1462a824661261a803
-
SHA256
c1bcfec2123c51d08732382d0f2cef2113b1c34cbb2e0c4c0fcfe7cc4f7bf1ad
-
SHA512
6afa8860b83f5d81da12df394adcbf9bc1be5932110af46e50bb384f0d7cf5a0b7755bd6d9d7bc53352738b35de6d02ef7fbff9cfc2f18db85c90ab203a7b8fe
-
SSDEEP
768:0H5uZXwpXUtnlUgcVt3SzMcdiHPznNqDrIHHy1p+4i3iQ4mZ:0H5ggpXUXKSI7NqQHS1p+3yU
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1120-1-0x0000000000910000-0x000000000093B000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4620 wrote to memory of 1120 4620 rundll32.exe 80 PID 4620 wrote to memory of 1120 4620 rundll32.exe 80 PID 4620 wrote to memory of 1120 4620 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4dc2c2b6806829cdb82732e9e21283a6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4dc2c2b6806829cdb82732e9e21283a6.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1120
-