Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
c7aa0fc22876a3b49aefdfa6322b72ec_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c7aa0fc22876a3b49aefdfa6322b72ec_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c7aa0fc22876a3b49aefdfa6322b72ec_JaffaCakes118.dll
-
Size
43KB
-
MD5
c7aa0fc22876a3b49aefdfa6322b72ec
-
SHA1
1f57fa5ab736e4f0c808d5d972463e60eda9dbe4
-
SHA256
a67d1d02d0c0449d4647480386e2066635fe9b4f20fef32f0f650193142eb676
-
SHA512
cd0e50e39fc51ecf26387b30cb5fbcb87a029fd0ef449e0cef4b1cfb71705d7b81cb46a21de01499404ac8709d2752d29323896dd35211c128d784a00ca059a2
-
SSDEEP
768:tv+5qD1szHOhbZRTNjf8br1gCLLKzQBYh2Vd9nZab8Cnz:U5qD1sD2TNir/LOuH9nkzz
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4184 wrote to memory of 4692 4184 rundll32.exe 84 PID 4184 wrote to memory of 4692 4184 rundll32.exe 84 PID 4184 wrote to memory of 4692 4184 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7aa0fc22876a3b49aefdfa6322b72ec_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7aa0fc22876a3b49aefdfa6322b72ec_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4692
-