Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 23:44
Behavioral task
behavioral1
Sample
b9884db8ac8a544d4fce619d762e1d71_JaffaCakes118.dll
Resource
win7-20240704-en
2 signatures
150 seconds
General
-
Target
b9884db8ac8a544d4fce619d762e1d71_JaffaCakes118.dll
-
Size
70KB
-
MD5
b9884db8ac8a544d4fce619d762e1d71
-
SHA1
0d0fe64fbe70721277bca3fd759bc1670014733f
-
SHA256
43499f0604d4f2479e86ad206e1fe5ac70f7f394dfdf65c1a3cf21a2407e2194
-
SHA512
61f077d5fa5b46ff47f38272942b1e64a4d3d621516b358c43e39b00175cb0e659d2fdc004ebd4a8226921578baa330385ae89fae8fa89051482744f81102237
-
SSDEEP
1536:jPezDwh9eI+dRj1Z+C5NRJ5wnBFOQwmhNn+vo+MANZ:CzD4ydRj1DJcnBFGmhNn+Q+M8Z
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2652 2756 rundll32.exe 30 PID 2756 wrote to memory of 2652 2756 rundll32.exe 30 PID 2756 wrote to memory of 2652 2756 rundll32.exe 30 PID 2756 wrote to memory of 2652 2756 rundll32.exe 30 PID 2756 wrote to memory of 2652 2756 rundll32.exe 30 PID 2756 wrote to memory of 2652 2756 rundll32.exe 30 PID 2756 wrote to memory of 2652 2756 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9884db8ac8a544d4fce619d762e1d71_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9884db8ac8a544d4fce619d762e1d71_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2652
-