Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
6a4fd85c72552f2ce3110848853e380b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6a4fd85c72552f2ce3110848853e380b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6a4fd85c72552f2ce3110848853e380b_JaffaCakes118.dll
-
Size
210KB
-
MD5
6a4fd85c72552f2ce3110848853e380b
-
SHA1
0f16a56f3ca727a6cd42e77f46121c887a037f07
-
SHA256
2c4c8bc501bee91e659e9ea3400c02781f1d5cffed76420fd1f83bc47bbcd0b1
-
SHA512
68ebcfa877cb294ced27bbadbc3cac3540ac80ffb921e47c25d03ec52065458025c182c2811e30040f5edb2a56c9adfc29aea2637737ffa142272bb49f0ad343
-
SSDEEP
3072:0ShMqfShMqfShMqfShMqfShMqfShMqfShMq:0SCqfSCqfSCqfSCqfSCqfSCqfSCq
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30 PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30 PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30 PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30 PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30 PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30 PID 2516 wrote to memory of 2108 2516 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6a4fd85c72552f2ce3110848853e380b_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6a4fd85c72552f2ce3110848853e380b_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:2108
-