Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 22:04
Behavioral task
behavioral1
Sample
716b7bd3296d44728498be37c5562573_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
716b7bd3296d44728498be37c5562573_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
716b7bd3296d44728498be37c5562573_JaffaCakes118.dll
-
Size
529KB
-
MD5
716b7bd3296d44728498be37c5562573
-
SHA1
03e04d24e53456fc8efdd2b038b7bd56558a9fe9
-
SHA256
fdcd54337d1a2d46a4944d2dc76aaecd4a32fe91e1905f6d09b1886ee868f89e
-
SHA512
183aeea1ab72b79786cef648c5b8b16821640329ecb93061573789bd0d65d54d19425195a9fb4484f96e10d589046efe8d30d27f3585d9868a1d4a5d76de2635
-
SSDEEP
12288:kxBA1U3kLjfEZaWhUMjDGG+bh074pSFXPC4p97TUKRxjL5:RUqLEoWWsy274p6fCDKjL5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1420 1996 rundll32.exe 29 PID 1996 wrote to memory of 1420 1996 rundll32.exe 29 PID 1996 wrote to memory of 1420 1996 rundll32.exe 29 PID 1996 wrote to memory of 1420 1996 rundll32.exe 29 PID 1996 wrote to memory of 1420 1996 rundll32.exe 29 PID 1996 wrote to memory of 1420 1996 rundll32.exe 29 PID 1996 wrote to memory of 1420 1996 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\716b7bd3296d44728498be37c5562573_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\716b7bd3296d44728498be37c5562573_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1420
-