Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
a4ea8ca6a9b5a8ee68eef77c0424ca9e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a4ea8ca6a9b5a8ee68eef77c0424ca9e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a4ea8ca6a9b5a8ee68eef77c0424ca9e_JaffaCakes118.dll
-
Size
184KB
-
MD5
a4ea8ca6a9b5a8ee68eef77c0424ca9e
-
SHA1
47d1098109639559f01e3e87df1eef5f482285c1
-
SHA256
a4c2c7e534af3c22c6c06091c15455304a96f4e70838ee2807388a894488d200
-
SHA512
dc4e34838b60ed62295217a35b809bf364f2e6d55bb138df47fe3e8affb22422dd7a1f9b5ec62f9a9337a89a0af75270611a53053cbbdff9da8e3b253684fffe
-
SSDEEP
3072:LzgzToEN4ocjC1HzLcXT9xR9mKH9Ttw35ODyLLfOhh:4z7zLcX5U6Tt85ODkLi
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1104 1724 rundll32.exe 30 PID 1724 wrote to memory of 1104 1724 rundll32.exe 30 PID 1724 wrote to memory of 1104 1724 rundll32.exe 30 PID 1724 wrote to memory of 1104 1724 rundll32.exe 30 PID 1724 wrote to memory of 1104 1724 rundll32.exe 30 PID 1724 wrote to memory of 1104 1724 rundll32.exe 30 PID 1724 wrote to memory of 1104 1724 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4ea8ca6a9b5a8ee68eef77c0424ca9e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a4ea8ca6a9b5a8ee68eef77c0424ca9e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1104
-