Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 19:50
Behavioral task
behavioral1
Sample
c78951653b2bcadb68af7f2b17dedaed_JaffaCakes118.dll
Resource
win7-20240708-en
3 signatures
150 seconds
General
-
Target
c78951653b2bcadb68af7f2b17dedaed_JaffaCakes118.dll
-
Size
11KB
-
MD5
c78951653b2bcadb68af7f2b17dedaed
-
SHA1
e9ae0eaab62a07de48568c9a65f77a6f06779c53
-
SHA256
55d474ab4893f7685dc8fb0b911efa91e1a7f7f05102e220943fa25a63577c82
-
SHA512
5dcd82a0179decc814aeb5cea3e2fd459d30190d4e258e815438474182f4658cf318de41ec67948c1a4271ffb423a0cd741ccddd02f63a99fdff1f6c6b8531a1
-
SSDEEP
192:fXyLBKUBvhyH28JiLi5t9Cu/1JB5vTb90U+aQNA8FIXYrU22Bc:gbRhD+0U2u/1LZ9JGA8eYv2B
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5000-0-0x0000000010000000-0x00000000100FF000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1952 5000 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3964 wrote to memory of 5000 3964 rundll32.exe 84 PID 3964 wrote to memory of 5000 3964 rundll32.exe 84 PID 3964 wrote to memory of 5000 3964 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c78951653b2bcadb68af7f2b17dedaed_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c78951653b2bcadb68af7f2b17dedaed_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 5963⤵
- Program crash
PID:1952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 50001⤵PID:3960