Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 22:14
Behavioral task
behavioral1
Sample
c1b44067b8b3ff8f5fb07c166591237e_JaffaCakes118.dll
Resource
win7-20240708-en
3 signatures
150 seconds
General
-
Target
c1b44067b8b3ff8f5fb07c166591237e_JaffaCakes118.dll
-
Size
58KB
-
MD5
c1b44067b8b3ff8f5fb07c166591237e
-
SHA1
a27f1a84bc44505497f444caf8d1813dfdceba30
-
SHA256
103b4fe8ee91c3b11c61cb62db951e831a58c4318200426a6172c58991edaa17
-
SHA512
caac0d695809fe166b3936310f5b0fff529054e541f344f9a4a88ed0c3990aae814b679242ef995d8c48b5ba25e4d2c91311745fae61d16f6354d746a8501129
-
SSDEEP
768:a8WbpVT0X8zhm2948thXXLbFCWesU2EZxkKSivtgcRiVFmhIOkl1zt5nt3oUI:+VZmwVh8DsZc6i1oVFLOkl1Z5t33I
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2272-1-0x0000000010000000-0x000000001000D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2272 2160 rundll32.exe 30 PID 2160 wrote to memory of 2272 2160 rundll32.exe 30 PID 2160 wrote to memory of 2272 2160 rundll32.exe 30 PID 2160 wrote to memory of 2272 2160 rundll32.exe 30 PID 2160 wrote to memory of 2272 2160 rundll32.exe 30 PID 2160 wrote to memory of 2272 2160 rundll32.exe 30 PID 2160 wrote to memory of 2272 2160 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1b44067b8b3ff8f5fb07c166591237e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1b44067b8b3ff8f5fb07c166591237e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2272
-