Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 16:18
Behavioral task
behavioral1
Sample
74cb894ca0ad6e91dabe1c1b07f5fb2d_JaffaCakes118.dll
Resource
win7-20240705-en
2 signatures
150 seconds
General
-
Target
74cb894ca0ad6e91dabe1c1b07f5fb2d_JaffaCakes118.dll
-
Size
59KB
-
MD5
74cb894ca0ad6e91dabe1c1b07f5fb2d
-
SHA1
37f217d6e3f15c91520d918447a4275c272abdbf
-
SHA256
c5ac4c4aa093b51d53a9e13c75ae85e848740640123f30ef0894a00b56c23a21
-
SHA512
0b407d6ee1c703e73f02c5bdd515cc3353f5fc4cbfe68163431d01f1a5259ae77ce62f276e20650f555175c3f0e1e1575a8b746f0c5a26b5f704e6bdaa6b44e8
-
SSDEEP
1536:mPO6KEVbsVP0gS0UbR1z9XNSng3XBEMVcwXX5T0o2l++:cMEVbsVcz0UblNS1cH5wo2lz
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1592 1584 rundll32.exe 30 PID 1584 wrote to memory of 1592 1584 rundll32.exe 30 PID 1584 wrote to memory of 1592 1584 rundll32.exe 30 PID 1584 wrote to memory of 1592 1584 rundll32.exe 30 PID 1584 wrote to memory of 1592 1584 rundll32.exe 30 PID 1584 wrote to memory of 1592 1584 rundll32.exe 30 PID 1584 wrote to memory of 1592 1584 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74cb894ca0ad6e91dabe1c1b07f5fb2d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74cb894ca0ad6e91dabe1c1b07f5fb2d_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1592
-