Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2025, 04:00
Behavioral task
behavioral1
Sample
JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe
-
Size
110KB
-
MD5
3170019581cd04f3e6a4bc85826137ae
-
SHA1
81be89ed0b47d8854f4565152b15b022ae81e63d
-
SHA256
22f75718d78b13c1194641ced65c22493571d6531658d335a4263d6e324e7856
-
SHA512
f48b7da2069e6ebac54f2c75fc63d3cc7218414931e0ef1c7910415ef440b5acfcaa1b590eb15afc697a6b69255a3a80eb66d9a4604d2b27b6dda223f8d46720
-
SSDEEP
3072:y6T6yGDVd6qSHVkFOnHlF/B4MewatpTw+6T3d9XYo:ya6yGhdt0Vfb/Sl/tRw+S3dp1
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/564-0-0x0000000000400000-0x000000000041D000-memory.dmp family_gh0strat behavioral2/files/0x000c000000023c00-6.dat family_gh0strat behavioral2/memory/564-5-0x0000000000400000-0x000000000041D000-memory.dmp family_gh0strat -
Gh0strat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility360.dll" JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe -
Deletes itself 1 IoCs
pid Process 4256 SVCHOST.EXE -
Loads dropped DLL 1 IoCs
pid Process 4256 SVCHOST.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility360.dll JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3170019581cd04f3e6a4bc85826137ae.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:564
-
C:\Windows\SysWOW64\SVCHOST.EXEC:\Windows\SysWOW64\SVCHOST.EXE -K NETSVCS -s FastUserSwitchingCompatibility1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD535ebc02c6938cac3f14149a9337b99bc
SHA1e960789ad038467a01b80329ee8eea9a2245ae4b
SHA256477d594d550f60a3133dcbaf1402f4b0a44a105ccafd13f92abf84a76310cc81
SHA51297a495cd407e0733058e9616d267e750f7aa680e2fb9bebf13c968bf906f52ab656cacc361bc42366be36c3c7e6d3424b2d56b52023c5408ba3356593f6d4d15