Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 22:37
Static task
static1
Behavioral task
behavioral1
Sample
693a976a5da6782e04c22ab2b54ec04d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
693a976a5da6782e04c22ab2b54ec04d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
693a976a5da6782e04c22ab2b54ec04d_JaffaCakes118.dll
-
Size
235KB
-
MD5
693a976a5da6782e04c22ab2b54ec04d
-
SHA1
6511d1ce234bf2bf6fdc5b2c2c82546709eea550
-
SHA256
faeb50ccd24e9057b391bf576a2d706816aaae04cf3030e3faa3cf9dca330a1a
-
SHA512
9500156a65b1053327b640b0775092ff2f815960c851a3a5b509d4394e0145a6add46579681313272f2e7e29b7aaac052bd479736d54ee546802b8c8ca72cc57
-
SSDEEP
6144:TGUkn8oTokLizzoF6loiN2MzxTGdTJRH48Q7oedS:CV5TB+ME1RdTGdTJRH4j7oYS
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2432 736 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1252 wrote to memory of 736 1252 rundll32.exe 86 PID 1252 wrote to memory of 736 1252 rundll32.exe 86 PID 1252 wrote to memory of 736 1252 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\693a976a5da6782e04c22ab2b54ec04d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\693a976a5da6782e04c22ab2b54ec04d_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 5803⤵
- Program crash
PID:2432
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 736 -ip 7361⤵PID:2056