Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
ace8f9708cd67ac3b36f0cadca90299a_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ace8f9708cd67ac3b36f0cadca90299a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ace8f9708cd67ac3b36f0cadca90299a_JaffaCakes118.dll
-
Size
133KB
-
MD5
ace8f9708cd67ac3b36f0cadca90299a
-
SHA1
fd2ca61ff21dfc46e0d0baf853bfb1ac5bc261f4
-
SHA256
9c8484c65ab5e69691175d0762c0e8e09ee5fee0d2ecbe75a31f5418a7eaece2
-
SHA512
0f32b15b9250ec993921bca72ebb69d3eedb2401772c2252e9467452ef3209a52521fdfe86f700388f035f5d7d6bfc0fa42dc18e3a69d8d733bc7f4e3b87c1e4
-
SSDEEP
1536:gmPgbL13HDuDfG2D8A+n3UirQY3BWXwkD9pRECj/r4TezvdS623lIO/9uH2tuQ+K:RgbLZHg4QYRodf4MS5v/9uHhQPl
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2860 2812 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2732 wrote to memory of 2812 2732 rundll32.exe 30 PID 2812 wrote to memory of 2860 2812 rundll32.exe 31 PID 2812 wrote to memory of 2860 2812 rundll32.exe 31 PID 2812 wrote to memory of 2860 2812 rundll32.exe 31 PID 2812 wrote to memory of 2860 2812 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ace8f9708cd67ac3b36f0cadca90299a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ace8f9708cd67ac3b36f0cadca90299a_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 2883⤵
- Program crash
PID:2860
-
-