Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
7019a5e496061814358f872840a6005c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7019a5e496061814358f872840a6005c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
7019a5e496061814358f872840a6005c_JaffaCakes118.dll
-
Size
255KB
-
MD5
7019a5e496061814358f872840a6005c
-
SHA1
6edfd0073d97d68d65b13a628dcbc72d3de579c4
-
SHA256
60dc4b76d855d95018b83670a04b37ff5b57abd09b3c26657e928313afcb06cd
-
SHA512
0b75ced123b8b1d3fdcb5b9cf87e54a5f82df86450c82726458588c0b8a12d5a4486a05c867af30441530603fbf14b8a1f4c05d432a63bdcc037c79683995947
-
SSDEEP
6144:qife/G4kR7h5uAS/HOVjzuugwl8C6axqEq3nhUMhDJA455O:qQgBklh5udHcuugL8gL33A4XO
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1996 wrote to memory of 832 1996 rundll32.exe 29 PID 1996 wrote to memory of 832 1996 rundll32.exe 29 PID 1996 wrote to memory of 832 1996 rundll32.exe 29 PID 1996 wrote to memory of 832 1996 rundll32.exe 29 PID 1996 wrote to memory of 832 1996 rundll32.exe 29 PID 1996 wrote to memory of 832 1996 rundll32.exe 29 PID 1996 wrote to memory of 832 1996 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7019a5e496061814358f872840a6005c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7019a5e496061814358f872840a6005c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:832
-