Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/03/2025, 01:34
Behavioral task
behavioral1
Sample
JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll
-
Size
124KB
-
MD5
627796b3a2378a52a97de4a208b0e882
-
SHA1
067d7a0076761ab7a0508fbad6f8b7cee6f2b531
-
SHA256
ad90b73ca0ba3aaabeb490445c123e2f2f79e1f29fed52a5c79bd1c2c5f16bdd
-
SHA512
239ea01d7bb8b0994890d82e493d6696c032f3495ccd6e24fa7cce191773593830dec0ebffaa839f9b8ed8d78ea0c067fc66305bb95fc7cfac88937bdc0fd1da
-
SSDEEP
3072:Bzk9z4Uh+yQAbAbu7NWtMpebimeN7kgMwzi/:uDTQAbbMbxg7kVwz
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000b000000012117-3.dat family_gh0strat behavioral1/memory/2848-4-0x0000000010000000-0x0000000010020000-memory.dmp family_gh0strat -
Gh0strat family
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2672 rundll32.exe Token: SeRestorePrivilege 2672 rundll32.exe Token: SeBackupPrivilege 2672 rundll32.exe Token: SeRestorePrivilege 2672 rundll32.exe Token: SeBackupPrivilege 2672 rundll32.exe Token: SeRestorePrivilege 2672 rundll32.exe Token: SeBackupPrivilege 2672 rundll32.exe Token: SeRestorePrivilege 2672 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2672 2716 rundll32.exe 30 PID 2716 wrote to memory of 2672 2716 rundll32.exe 30 PID 2716 wrote to memory of 2672 2716 rundll32.exe 30 PID 2716 wrote to memory of 2672 2716 rundll32.exe 30 PID 2716 wrote to memory of 2672 2716 rundll32.exe 30 PID 2716 wrote to memory of 2672 2716 rundll32.exe 30 PID 2716 wrote to memory of 2672 2716 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5505edfc7590d1fcc9cba564d5e0aea0a
SHA13616a5bfb749281ef7f7cbe03a0de07e5ef5f2d4
SHA2565d963d271a5c0772d5772b39c91e6fb584903921dbac1bc640c48be368799c0b
SHA5122a4babd4d19bd9a6aef9a5393c85f6bd324a9d35a7985f450e7bd0cb18d6196623ac815551cad393d06c69484f43205c5740998c029f672322ac9e5d6c945ba9
