Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
70399193443acee14bfe34402527b825_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70399193443acee14bfe34402527b825_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
70399193443acee14bfe34402527b825_JaffaCakes118.dll
-
Size
56KB
-
MD5
70399193443acee14bfe34402527b825
-
SHA1
82ecb0ad242daf9cd8626a8b83dd2293657167a2
-
SHA256
5896aae0d5cf1a676705d91bf64f670e8be125b9b1ea0cc0832095e9c7b6c842
-
SHA512
8af29855c2246a549a42085e6f23c5059ca3d317bf47973e9a75d0edbf6983d8c756ca29bfbaaff92c5cfedd51652d9b86afdc7a13d5a0b454a7f9dc651a4e99
-
SSDEEP
1536:P+ItLQAg0Y+WiABVQohIpNhqCdP84iODD7a8CTb:1tQAm+WiABeohIpNnva8CTb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2520 2372 rundll32.exe 30 PID 2372 wrote to memory of 2520 2372 rundll32.exe 30 PID 2372 wrote to memory of 2520 2372 rundll32.exe 30 PID 2372 wrote to memory of 2520 2372 rundll32.exe 30 PID 2372 wrote to memory of 2520 2372 rundll32.exe 30 PID 2372 wrote to memory of 2520 2372 rundll32.exe 30 PID 2372 wrote to memory of 2520 2372 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70399193443acee14bfe34402527b825_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\70399193443acee14bfe34402527b825_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2520
-