Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 07:38
Behavioral task
behavioral1
Sample
6ac3d292345ac0373616d3b00153826e_JaffaCakes118.dll
Resource
win7-20240705-en
3 signatures
150 seconds
General
-
Target
6ac3d292345ac0373616d3b00153826e_JaffaCakes118.dll
-
Size
53KB
-
MD5
6ac3d292345ac0373616d3b00153826e
-
SHA1
198bf6a7d10cd61f941175bfbb23f7a0590c86d9
-
SHA256
bc347c4c9f083b248074283fab245510e369762119fd75ba549744974ecbd11a
-
SHA512
71f847156992234c674672ec31378aa2ace184a4ce1a34caca234a5e63c522c3d316c8aa96ccd991a7d3247b6bd43f0a0bc918cad9e7f41bb5507166028b3acc
-
SSDEEP
1536:RVxobYSi331XbluOOMpz2tVLZon9+qLdDxi:TxobK331XQIktFZon9/Lri
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2800-0-0x0000000010000000-0x000000001000D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4384 wrote to memory of 2800 4384 rundll32.exe 84 PID 4384 wrote to memory of 2800 4384 rundll32.exe 84 PID 4384 wrote to memory of 2800 4384 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ac3d292345ac0373616d3b00153826e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ac3d292345ac0373616d3b00153826e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2800
-