Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
6ffdffa9105365b2d40637824e146e18_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6ffdffa9105365b2d40637824e146e18_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6ffdffa9105365b2d40637824e146e18_JaffaCakes118.dll
-
Size
239KB
-
MD5
6ffdffa9105365b2d40637824e146e18
-
SHA1
ac4ce830f3f93e36b2e7099c14e9ca0851988a93
-
SHA256
432d609d2004f9025aacca77135687e22652e42fd1979229d2fe87a6d5eba83a
-
SHA512
753462eb48c08bbc9c09c3350a83605cb6f741e98634144c0836e88668428a61c62aae1f67c7e9c7cd1baf5137ff2ffdcd4275ebe02aece500f8112b2ae27204
-
SSDEEP
3072:iGHWN2g4SGohbwFu2vXXfUpEmwhmSiaTbf5YtApoXG9WQnbueeeeeeeeYZcrp/ko:iG/gY4ozBB1Tbp6rdJ/IC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30 PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30 PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30 PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30 PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30 PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30 PID 2484 wrote to memory of 2720 2484 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6ffdffa9105365b2d40637824e146e18_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\6ffdffa9105365b2d40637824e146e18_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:2720
-