Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll
-
Size
213KB
-
MD5
6938469cb3cd9996f8741e0fe4f0da5e
-
SHA1
03dfb5fe5c7be525fd183e08233b9059cd5d1a64
-
SHA256
144139168bd9a8ab047977a1ab6e45a5cdfda1a14cf75b9082280b6c1233e30d
-
SHA512
05c7d347f18aec548798d6203679624ec62dc784a90139cc83afaecb605dc10f7f141ee77bc16f20e686a735d72f99b62def53b5a1643e84a846d3f5be52304b
-
SSDEEP
3072:4ZO4Rd/yv8GoZegvVSbymnDSnyHOTgkTCxktFy7JHVtWZdncjlqDDHgXJYVXZ:F4r/iEIznun5gsdW7NVtWDcqkYVXZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2632 2372 rundll32.exe 31 PID 2372 wrote to memory of 2632 2372 rundll32.exe 31 PID 2372 wrote to memory of 2632 2372 rundll32.exe 31 PID 2372 wrote to memory of 2632 2372 rundll32.exe 31 PID 2372 wrote to memory of 2632 2372 rundll32.exe 31 PID 2372 wrote to memory of 2632 2372 rundll32.exe 31 PID 2372 wrote to memory of 2632 2372 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6938469cb3cd9996f8741e0fe4f0da5e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2632
-