Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
8e11f222a8330a46c9108c48d4a21062_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8e11f222a8330a46c9108c48d4a21062_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8e11f222a8330a46c9108c48d4a21062_JaffaCakes118.dll
-
Size
48KB
-
MD5
8e11f222a8330a46c9108c48d4a21062
-
SHA1
eae359eac46fa216d42382a533a64f4a3b47e2f8
-
SHA256
0099ebb09a5ac4f83cd5cf36e9f070b8585c5ec7eff07d0fc97a419dad5282ca
-
SHA512
2b9b3421d00440098bca4a995440ec0f99e16b1a902c3a0065fba2dc9ccf658fa9748bc389d7fb52c05094cc206b93630bb5db27e3c06467dca011795e92d24c
-
SSDEEP
768:yGdaJQIyUBpyge2RxeDLCPlMW5WsOkAvSzL56rx64R6TR/IUt6a4szx:/IyUB7e2RoDLCdLWsOVqzLErxzEhITa
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2352 2912 rundll32.exe 30 PID 2912 wrote to memory of 2352 2912 rundll32.exe 30 PID 2912 wrote to memory of 2352 2912 rundll32.exe 30 PID 2912 wrote to memory of 2352 2912 rundll32.exe 30 PID 2912 wrote to memory of 2352 2912 rundll32.exe 30 PID 2912 wrote to memory of 2352 2912 rundll32.exe 30 PID 2912 wrote to memory of 2352 2912 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e11f222a8330a46c9108c48d4a21062_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e11f222a8330a46c9108c48d4a21062_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2352
-