Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:56
Behavioral task
behavioral1
Sample
81e0a186e19a2d37c27a552ff7eccba3_JaffaCakes118.dll
Resource
win7-20240729-en
3 signatures
150 seconds
General
-
Target
81e0a186e19a2d37c27a552ff7eccba3_JaffaCakes118.dll
-
Size
57KB
-
MD5
81e0a186e19a2d37c27a552ff7eccba3
-
SHA1
77c2dbf02d9ca1ea64150bc9e706825e477bf5b1
-
SHA256
96a242bc36fb73f6fdaedc804a9ce25a036db090803d643cc67fc97a5ddaae89
-
SHA512
3e51b4b59f8acf401dffb78697e0c89d19d91165cca81ce1b4c40274e8ecc8c889bf76cc604934c18d497bc2bbab4edfaa97b4f4880a919f0b315796e10c2bf7
-
SSDEEP
768:4xFmDJua1lNAF3LjHCmCHLI5yMI6dHTrLIixvStpUF7c+eOWtzfmTGnPpw1MdkkF:4xFcH1W3/igs6VLIiFwUWtzrdeu
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1956-1-0x0000000010000000-0x000000001000E000-memory.dmp upx behavioral1/memory/1956-3-0x0000000010000000-0x000000001000E000-memory.dmp upx behavioral1/memory/1956-2-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2716 wrote to memory of 1956 2716 rundll32.exe 30 PID 2716 wrote to memory of 1956 2716 rundll32.exe 30 PID 2716 wrote to memory of 1956 2716 rundll32.exe 30 PID 2716 wrote to memory of 1956 2716 rundll32.exe 30 PID 2716 wrote to memory of 1956 2716 rundll32.exe 30 PID 2716 wrote to memory of 1956 2716 rundll32.exe 30 PID 2716 wrote to memory of 1956 2716 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\81e0a186e19a2d37c27a552ff7eccba3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\81e0a186e19a2d37c27a552ff7eccba3_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1956
-