Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
a8e7c4c3c77da6884179b9ff08ebbb10_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a8e7c4c3c77da6884179b9ff08ebbb10_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a8e7c4c3c77da6884179b9ff08ebbb10_JaffaCakes118.dll
-
Size
60KB
-
MD5
a8e7c4c3c77da6884179b9ff08ebbb10
-
SHA1
c5ce1b25ac2aff0b64b7a81293efe9e640cf3777
-
SHA256
bbccb3406706e01ae5f48b50a36a47afe1b2cd4e6932055908f7ae0fdaea2577
-
SHA512
c1286dbe0f560c5ae646559ce9475cf84c49248da8c380410d3f9f7a37980462d0ea6de90adb882558c919437d3f48c3bc400afe691f3f1c2765b28e8dc90afe
-
SSDEEP
768:LC7EVV3L8bftleDttNoapwIhHzus5pFyqHOBah2zPvLdS5mJHq9cp/FHyW9roc0V:Rb8hGNO65pFyAO1zPvLgeq9c3yIsc
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2716 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 560 wrote to memory of 2716 560 rundll32.exe 29 PID 560 wrote to memory of 2716 560 rundll32.exe 29 PID 560 wrote to memory of 2716 560 rundll32.exe 29 PID 560 wrote to memory of 2716 560 rundll32.exe 29 PID 560 wrote to memory of 2716 560 rundll32.exe 29 PID 560 wrote to memory of 2716 560 rundll32.exe 29 PID 560 wrote to memory of 2716 560 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8e7c4c3c77da6884179b9ff08ebbb10_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8e7c4c3c77da6884179b9ff08ebbb10_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2716
-