Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 18:38
Behavioral task
behavioral1
Sample
b060d3a99bed7800196a2e44d1a8a983_JaffaCakes118.dll
Resource
win7-20240704-en
3 signatures
150 seconds
General
-
Target
b060d3a99bed7800196a2e44d1a8a983_JaffaCakes118.dll
-
Size
88KB
-
MD5
b060d3a99bed7800196a2e44d1a8a983
-
SHA1
0b0e2a3adcb5d98b28efe778395eac1a8e24677b
-
SHA256
44e9e83f42f89adb1dc1c8859f837dd7ace36c46eefd07f2c955212be813a7d9
-
SHA512
a53de90058242cded88c16150d55a35d981010241f815b8c71319452b253bec97cb751c50136f832214415f8026a77e638b8639bbffae1e7030ce11a1bcdcd80
-
SSDEEP
1536:Hswbju/BpFaOVhh5JDZitRctN9MPh/kiuDeF3C:HVbjuJpFPZ5JtiD2N9Mh4eF3C
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2012-0-0x0000000010000000-0x000000001000D000-memory.dmp upx behavioral1/memory/2012-2-0x0000000010000000-0x000000001000D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2012 2620 rundll32.exe 31 PID 2620 wrote to memory of 2012 2620 rundll32.exe 31 PID 2620 wrote to memory of 2012 2620 rundll32.exe 31 PID 2620 wrote to memory of 2012 2620 rundll32.exe 31 PID 2620 wrote to memory of 2012 2620 rundll32.exe 31 PID 2620 wrote to memory of 2012 2620 rundll32.exe 31 PID 2620 wrote to memory of 2012 2620 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b060d3a99bed7800196a2e44d1a8a983_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b060d3a99bed7800196a2e44d1a8a983_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2012
-