Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2025, 01:34
Behavioral task
behavioral1
Sample
JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll
-
Size
124KB
-
MD5
627796b3a2378a52a97de4a208b0e882
-
SHA1
067d7a0076761ab7a0508fbad6f8b7cee6f2b531
-
SHA256
ad90b73ca0ba3aaabeb490445c123e2f2f79e1f29fed52a5c79bd1c2c5f16bdd
-
SHA512
239ea01d7bb8b0994890d82e493d6696c032f3495ccd6e24fa7cce191773593830dec0ebffaa839f9b8ed8d78ea0c067fc66305bb95fc7cfac88937bdc0fd1da
-
SSDEEP
3072:Bzk9z4Uh+yQAbAbu7NWtMpebimeN7kgMwzi/:uDTQAbbMbxg7kVwz
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023bf9-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4312 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe 4312 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1200 rundll32.exe Token: SeRestorePrivilege 1200 rundll32.exe Token: SeBackupPrivilege 1200 rundll32.exe Token: SeRestorePrivilege 1200 rundll32.exe Token: SeBackupPrivilege 1200 rundll32.exe Token: SeRestorePrivilege 1200 rundll32.exe Token: SeBackupPrivilege 1200 rundll32.exe Token: SeRestorePrivilege 1200 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5000 wrote to memory of 1200 5000 rundll32.exe 87 PID 5000 wrote to memory of 1200 5000 rundll32.exe 87 PID 5000 wrote to memory of 1200 5000 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_627796b3a2378a52a97de4a208b0e882.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.1MB
MD57b13a8517f874cf41a06ab162fb670f2
SHA180749960133743623124e719957416fb0b39b3ff
SHA2566e415cda2703a19bef04c8f6ad4570fef6e4dc1765c32af967487a1c0591be65
SHA5126ea342fff53bfd91ea302d13fa5e3989eeab132dfd701a41be5cb0c49d37d69a97c5f8240e6869dc57d2df6a1477955e04e76560f3c9aebcb77d69097a69ff19
