Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll
-
Size
4KB
-
MD5
cdf48001cf8b0b0efd548173a8855290
-
SHA1
eb324da3941d153f2f60a2cb2dcb93489af678a0
-
SHA256
f7877df230714974c0de380f0504949d9f1684172fef824ec492033bd6687154
-
SHA512
f87c5536b451d1425063fb30381d4a1bb888cb3e7b3443f545953b36076e4238c8cfefc431de9cbd43a18fce6be7a829f50111d8572476e8f91deebf899b05a2
-
SSDEEP
96:Z1GWnz+08VMZWPlygGB5scswbHicTj0D7ckM320v:SWzrpZWP475scswbHicTj2E
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2308 2324 rundll32.exe 31 PID 2324 wrote to memory of 2308 2324 rundll32.exe 31 PID 2324 wrote to memory of 2308 2324 rundll32.exe 31 PID 2324 wrote to memory of 2308 2324 rundll32.exe 31 PID 2324 wrote to memory of 2308 2324 rundll32.exe 31 PID 2324 wrote to memory of 2308 2324 rundll32.exe 31 PID 2324 wrote to memory of 2308 2324 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2308
-