Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 11:39
Behavioral task
behavioral1
Sample
bb93817a85dc0350c3d4b1a8b48a9006_JaffaCakes118.dll
Resource
win7-20240704-en
2 signatures
150 seconds
General
-
Target
bb93817a85dc0350c3d4b1a8b48a9006_JaffaCakes118.dll
-
Size
4.1MB
-
MD5
bb93817a85dc0350c3d4b1a8b48a9006
-
SHA1
e5f7f3596cfce69fc6107bc3fa62f503c24cb91b
-
SHA256
aefb39f2cf2969d80d594248a67f1584035c0de859ce8f08f2b3d77ce682d32e
-
SHA512
cd4d9f052b2f45db577dcc4ba83dfdb3d6890ef36cb3ddcb322ae2019b1e0adea8fee5863f95378c85411020e60641e3256b2d0962ed7f757f9c969914d6965c
-
SSDEEP
1536:w2owFRZBLWz+M47QvqBxBAP9bDXoyTWAuSZUv04hJRoYToUT9s:whw/3LS+ivqnBAP9/9T6US0uJ3T2
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3316-0-0x0000000010000000-0x0000000010410000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1300 wrote to memory of 3316 1300 rundll32.exe 86 PID 1300 wrote to memory of 3316 1300 rundll32.exe 86 PID 1300 wrote to memory of 3316 1300 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bb93817a85dc0350c3d4b1a8b48a9006_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bb93817a85dc0350c3d4b1a8b48a9006_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3316
-