Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
ceb517a5b911a0180da83ded005b33e3_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ceb517a5b911a0180da83ded005b33e3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ceb517a5b911a0180da83ded005b33e3_JaffaCakes118.dll
-
Size
189KB
-
MD5
ceb517a5b911a0180da83ded005b33e3
-
SHA1
230c344ce0d2c8ee1a53928500a9a0fdc1fb64ad
-
SHA256
597ce54444671d8bbb5e61352ef6d48c00f8f322545ae571f08d564726212b41
-
SHA512
d2205e626f8368b7965926456c898f68ebfd300ad5bd27c54802e001c0f4ae424f6637aa268265e4fe6c6e0c3a557e022b7cb3979a62da9636b30a58830b3223
-
SSDEEP
3072:+n3Ou8LMBSjHbMHozn5bVM7RWzhrjdeIpGhtZNsPHmiIolM11kW8p8Rgv:+3kLMOhz5q7ojCL0IN8
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 548 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3596 set thread context of 548 3596 rundll32.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 64 wrote to memory of 3596 64 rundll32.exe 83 PID 64 wrote to memory of 3596 64 rundll32.exe 83 PID 64 wrote to memory of 3596 64 rundll32.exe 83 PID 3596 wrote to memory of 548 3596 rundll32.exe 86 PID 3596 wrote to memory of 548 3596 rundll32.exe 86 PID 3596 wrote to memory of 548 3596 rundll32.exe 86 PID 3596 wrote to memory of 548 3596 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ceb517a5b911a0180da83ded005b33e3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ceb517a5b911a0180da83ded005b33e3_JaffaCakes118.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:548
-
-