Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll
-
Size
4KB
-
MD5
cdf48001cf8b0b0efd548173a8855290
-
SHA1
eb324da3941d153f2f60a2cb2dcb93489af678a0
-
SHA256
f7877df230714974c0de380f0504949d9f1684172fef824ec492033bd6687154
-
SHA512
f87c5536b451d1425063fb30381d4a1bb888cb3e7b3443f545953b36076e4238c8cfefc431de9cbd43a18fce6be7a829f50111d8572476e8f91deebf899b05a2
-
SSDEEP
96:Z1GWnz+08VMZWPlygGB5scswbHicTj0D7ckM320v:SWzrpZWP475scswbHicTj2E
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 4212 4824 WerFault.exe 84 3748 4824 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4824 1436 rundll32.exe 84 PID 1436 wrote to memory of 4824 1436 rundll32.exe 84 PID 1436 wrote to memory of 4824 1436 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cdf48001cf8b0b0efd548173a8855290_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 6003⤵
- Program crash
PID:4212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 6083⤵
- Program crash
PID:3748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 48241⤵PID:3684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4824 -ip 48241⤵PID:3524