Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
8aeea04b4080ffef23061925c4753692_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8aeea04b4080ffef23061925c4753692_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8aeea04b4080ffef23061925c4753692_JaffaCakes118.dll
-
Size
30KB
-
MD5
8aeea04b4080ffef23061925c4753692
-
SHA1
4afafdeb0be3742b6e14ea4b429949e4674c3439
-
SHA256
4ec542ce0a8bcacb6a3e732e55697601f12f0bcd348bbe26af8d76c786c9ebeb
-
SHA512
eb80a8b4abb2ef6c28ab14d6bfa53087f9bf62b60a86605f342f452f65d1fc8b8c8f9003a4626bae56c938deff6fcd43f08d073e1425bee83dee85166b051a65
-
SSDEEP
384:LyfXYGPKLvM1TunFXg666HmH14wawlp5dv7zoahf5/3B4z9MPTKCR9LuBBQARQkK:LyfXYGCd4VLVl/wC2BBQARQkVX7Ve
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2420 1068 rundll32.exe 84 PID 1068 wrote to memory of 2420 1068 rundll32.exe 84 PID 1068 wrote to memory of 2420 1068 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8aeea04b4080ffef23061925c4753692_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8aeea04b4080ffef23061925c4753692_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2420
-