Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll
-
Size
100KB
-
MD5
6f7c4115bc5ec8d4d580912908015c2c
-
SHA1
3ec98c22cd19f745d96033ac1fd69b0b392ba7e8
-
SHA256
ccc68c102deebf00ff9a48f8de41d08782af332bf09aafd00b88815e0dbf383c
-
SHA512
271a59062cecee241946ac52f6d19aa3c94d760d933139fe999ea479b3d574696a0e21cc82ec19e0592e34a181280ec1d0fef74c1ae4b466cfbbfccae5b3cd9a
-
SSDEEP
1536:NxJ/UblGuKOsKuMVp6y6ij58K46CweMrGhNucj0rVinxTHyn:TJYjnU8p6y6pn6ixTSn
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1988 4588 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4588 4864 rundll32.exe 84 PID 4864 wrote to memory of 4588 4864 rundll32.exe 84 PID 4864 wrote to memory of 4588 4864 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 6883⤵
- Program crash
PID:1988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4588 -ip 45881⤵PID:1888