Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
ac240dbe905df22d5cb138ca23cc2150_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ac240dbe905df22d5cb138ca23cc2150_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ac240dbe905df22d5cb138ca23cc2150_JaffaCakes118.dll
-
Size
19KB
-
MD5
ac240dbe905df22d5cb138ca23cc2150
-
SHA1
9554b8299408803e8980f114f024550320494707
-
SHA256
8dfd8ef265057c63b3a411469572d0bb90638a7d2310821203395a91333359f4
-
SHA512
73186ce7e8eb36f892d7caf8a15d4a4012bbc8ef0ed8dd2fe9973bb166f98f6219323d1bef89bbb0db9afc6d0296dca711791b2bf9b4cbbc93e5d7f6d0219c0a
-
SSDEEP
384:KDkLA8Ax++xRLzx7XrzBTRDWrkIECn8sC0+ou+ou+oA+ox+oxWS4EWr:ZLA8AwcLt7XBUrQB+ooqN2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4620 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4504 wrote to memory of 4620 4504 rundll32.exe 83 PID 4504 wrote to memory of 4620 4504 rundll32.exe 83 PID 4504 wrote to memory of 4620 4504 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac240dbe905df22d5cb138ca23cc2150_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac240dbe905df22d5cb138ca23cc2150_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4620
-