Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
b4b7242ed84bf1d00959da61f620193c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b4b7242ed84bf1d00959da61f620193c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b4b7242ed84bf1d00959da61f620193c_JaffaCakes118.dll
-
Size
32KB
-
MD5
b4b7242ed84bf1d00959da61f620193c
-
SHA1
9b3c22f721b69c05c11e6150b5ea1205938f3ffa
-
SHA256
0e9b38aaccc1448f8fd78a5b95c96b1eda05fad0efb343200d948cb87c9f9301
-
SHA512
90a5784fae9b6295d07e6e30b380f92852256fc2f6281aba6c736988843986fa41aceb50d4e8c16cc4c70fadbb3659cac77f01fc00b24bff2728c888145d1134
-
SSDEEP
384:mFqL0mh9NfNryPHkx0bzSYAk8kVfO5Y4ZXXqGa/77y4gk+vjt4mt6dyRH+eAvvC1:8qLJLLEIkVf5/75L+vjGm4dA5ACRILfQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4512 wrote to memory of 3036 4512 rundll32.exe 84 PID 4512 wrote to memory of 3036 4512 rundll32.exe 84 PID 4512 wrote to memory of 3036 4512 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4b7242ed84bf1d00959da61f620193c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4b7242ed84bf1d00959da61f620193c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3036
-