Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll
-
Size
57KB
-
MD5
a7830f2cad12ddff1780a70e9a044753
-
SHA1
6d4a22cf3e3218d976f3cf6321e4113b2ff1b7dc
-
SHA256
2d3ca855f9e98bc78ed7c936221d579e7855a421ee811357212f06b224f0f45d
-
SHA512
ac37b29069403cca6d0e73de1011c41529b6608c57cd84bb5b56c0cb9e94e355660a11d6b47dbeb7cbea23ba7da22038b005b6794d212ae2c8996b255be3d06c
-
SSDEEP
768:f776wakBZ+BPkRsOBaecI6iDiIcf89IMNnwJigw6uUKQ/gvP8AEqKjojsm1kVXFZ:ff3+pqsvbi2Pf89IMKtjuAk8A0zdZMo
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2388 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2524 wrote to memory of 2388 2524 rundll32.exe 30 PID 2388 wrote to memory of 1268 2388 rundll32.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2388
-
-