Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 16:54
Behavioral task
behavioral1
Sample
8b2e841d407f2c48c7aa13824de20366_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8b2e841d407f2c48c7aa13824de20366_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8b2e841d407f2c48c7aa13824de20366_JaffaCakes118.dll
-
Size
161KB
-
MD5
8b2e841d407f2c48c7aa13824de20366
-
SHA1
ebdac406a936c9c4526bcd4083ee14e911b94ee0
-
SHA256
acbe12c0cf239709b9bbf4de4455206604501d52840362bd4187a183332146e0
-
SHA512
aec1ea297208d414c2b1512f566a3a88e9d025b024d3e330e210ccd7e28e9b75e879a65c594406d23d60e796a92eea854f7250f1f0f147a23fcede44cd9cf0fa
-
SSDEEP
3072:P3HkmvfTbr396HM0XU+aDembri59tuvdZhhL/H0XpmT9T7/xqEv+/nIdtNu:ZXT/n+aCP0vdZhhL0MTZ/cMpI
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1328 1920 rundll32.exe 30 PID 1920 wrote to memory of 1328 1920 rundll32.exe 30 PID 1920 wrote to memory of 1328 1920 rundll32.exe 30 PID 1920 wrote to memory of 1328 1920 rundll32.exe 30 PID 1920 wrote to memory of 1328 1920 rundll32.exe 30 PID 1920 wrote to memory of 1328 1920 rundll32.exe 30 PID 1920 wrote to memory of 1328 1920 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b2e841d407f2c48c7aa13824de20366_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b2e841d407f2c48c7aa13824de20366_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1328
-