Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
adeda7c0407beb8438679f18fa8118f5_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
adeda7c0407beb8438679f18fa8118f5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
adeda7c0407beb8438679f18fa8118f5_JaffaCakes118.dll
-
Size
36KB
-
MD5
adeda7c0407beb8438679f18fa8118f5
-
SHA1
c4940108820661ef4f906262d6e2ca20cab6f057
-
SHA256
c2d35e504014854990008742d626a79e309b0b05876e432c22b87674e04d2d0f
-
SHA512
2bd18a3341cbad8b43b74289f8cd0a5ed14bcd26246d4778e90f821593fbf4c82dbe5e31418b14cd2c49eecbf6f13706cbbf991ffa6535274803c2c2db9f936a
-
SSDEEP
768:qBRu0Ttvh9nTPQsZDFN85zwBLHIb5jaAxvOTGUs:qDh9nT4sLN8WBLHuaDTGj
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1844 4868 rundll32.exe 84 PID 4868 wrote to memory of 1844 4868 rundll32.exe 84 PID 4868 wrote to memory of 1844 4868 rundll32.exe 84 PID 1844 wrote to memory of 864 1844 rundll32.exe 85 PID 1844 wrote to memory of 864 1844 rundll32.exe 85 PID 1844 wrote to memory of 864 1844 rundll32.exe 85 PID 864 wrote to memory of 3780 864 net.exe 88 PID 864 wrote to memory of 3780 864 net.exe 88 PID 864 wrote to memory of 3780 864 net.exe 88 PID 1844 wrote to memory of 4856 1844 rundll32.exe 89 PID 1844 wrote to memory of 4856 1844 rundll32.exe 89 PID 1844 wrote to memory of 4856 1844 rundll32.exe 89 PID 4856 wrote to memory of 932 4856 net.exe 91 PID 4856 wrote to memory of 932 4856 net.exe 91 PID 4856 wrote to memory of 932 4856 net.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adeda7c0407beb8438679f18fa8118f5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\adeda7c0407beb8438679f18fa8118f5_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\net.exenet stop winss3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop winss4⤵
- System Location Discovery: System Language Discovery
PID:3780
-
-
-
C:\Windows\SysWOW64\net.exenet stop OcHealthMon3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OcHealthMon4⤵
- System Location Discovery: System Language Discovery
PID:932
-
-
-