Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
01/03/2025, 09:42
Behavioral task
behavioral1
Sample
JaffaCakes118_383abae571ca8375519159a10f65b6ce.dll
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_383abae571ca8375519159a10f65b6ce.dll
-
Size
134KB
-
MD5
383abae571ca8375519159a10f65b6ce
-
SHA1
cd3b08979c9e43b77253d9889de8e14b18e21efa
-
SHA256
ddd5d83bac6b59452fd12004c1e2617969ddb19ba2a52ee5131a931581fcd5c6
-
SHA512
7a979203e9283e78ac8a1b609f28abad3925f884978d0d65ee538836a3e79b4156fae8946c29e7591fc86b05598ecff8e5fd0f06fe7073596860d4526026b900
-
SSDEEP
3072:Pt3hex9YRhl9RorSb7ton26eW8MG1DAju8gnRC9KaF:V3hV5b77owmj3URu/F
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
resource yara_rule behavioral1/memory/1612-0-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat behavioral1/memory/1612-1-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat behavioral1/files/0x002a0000000170f8-5.dat family_gh0strat behavioral1/memory/2784-7-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat behavioral1/memory/2784-8-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2784 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\mysql.ini rundll32.exe File created C:\Program Files (x86)\Lhij\mysql.ini rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe 2784 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1612 rundll32.exe Token: SeRestorePrivilege 1612 rundll32.exe Token: SeBackupPrivilege 1612 rundll32.exe Token: SeRestorePrivilege 1612 rundll32.exe Token: SeBackupPrivilege 1612 rundll32.exe Token: SeRestorePrivilege 1612 rundll32.exe Token: SeBackupPrivilege 1612 rundll32.exe Token: SeRestorePrivilege 1612 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 564 wrote to memory of 1612 564 rundll32.exe 30 PID 564 wrote to memory of 1612 564 rundll32.exe 30 PID 564 wrote to memory of 1612 564 rundll32.exe 30 PID 564 wrote to memory of 1612 564 rundll32.exe 30 PID 564 wrote to memory of 1612 564 rundll32.exe 30 PID 564 wrote to memory of 1612 564 rundll32.exe 30 PID 564 wrote to memory of 1612 564 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_383abae571ca8375519159a10f65b6ce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_383abae571ca8375519159a10f65b6ce.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.0MB
MD56d8dd4a082e288ee77948da811268680
SHA11290e319841f0a9358bed32a8465edb1c12b7fea
SHA256712a07dc91bacaaad82f75a996962dbf93e79846b886e6a86a1084de7e541169
SHA5122656455cbfe7bd144db51031c47c05e5531e79405d042f77e872ac09e8d435343a972d9d658be84883d4df5b8ad70d8a7871f5e42688b5c93537f9535690a8e5