Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 05:19
Static task
static1
Behavioral task
behavioral1
Sample
b23b554246f1886faf9183720de1793a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b23b554246f1886faf9183720de1793a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b23b554246f1886faf9183720de1793a_JaffaCakes118.dll
-
Size
101KB
-
MD5
b23b554246f1886faf9183720de1793a
-
SHA1
b0e285b94831c177e805074ad5a4848c83b4cdad
-
SHA256
12564dd6013d7294d57ee77c6eff2bc2f2dfe1cafcd0be26c18bb0095e861ac3
-
SHA512
a20cd059233138d199e7c4dbb94b6dc30bc6eb2d0fe0232742ddbbfe7cc2e95103aca9896f8625af70af0723889a21f11449706d802a7740b577a705eb3aac7f
-
SSDEEP
3072:rQQ26NMFZDll46slpEl0qZYfkaK0pQZ7L:rQQPMFZlJ0pOakaJA
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 1708 2372 rundll32.exe 30 PID 2372 wrote to memory of 1708 2372 rundll32.exe 30 PID 2372 wrote to memory of 1708 2372 rundll32.exe 30 PID 2372 wrote to memory of 1708 2372 rundll32.exe 30 PID 2372 wrote to memory of 1708 2372 rundll32.exe 30 PID 2372 wrote to memory of 1708 2372 rundll32.exe 30 PID 2372 wrote to memory of 1708 2372 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b23b554246f1886faf9183720de1793a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b23b554246f1886faf9183720de1793a_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1708
-