Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
cf2b63991ec9ea28d93fb4b1b56fd32f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf2b63991ec9ea28d93fb4b1b56fd32f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cf2b63991ec9ea28d93fb4b1b56fd32f_JaffaCakes118.dll
-
Size
21KB
-
MD5
cf2b63991ec9ea28d93fb4b1b56fd32f
-
SHA1
5cee04c019f98382507d374e7bf36b2b78f51fd3
-
SHA256
0dc20b065b285b550ead1c16fad8515647a536fc695bcf94088c6d76a9bb25a0
-
SHA512
d2853b8352efbc35958f6b4ee8b153c426a41b8c3de95c11d6ffd84a69e6fb3438729e14e9cf7f8a55271197bf6d101b9096170ef8d6229bba8e8d22bc97554d
-
SSDEEP
384:vBWWTEcWscQvWyr6FUYIVuLqDeoyo21yllOc5XOYS2IRartp9tlQT/ci6xPnL90J:O2QE6FaDepo21Y5XzS2i8p9vr1WJ6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2308 2956 rundll32.exe 29 PID 2956 wrote to memory of 2308 2956 rundll32.exe 29 PID 2956 wrote to memory of 2308 2956 rundll32.exe 29 PID 2956 wrote to memory of 2308 2956 rundll32.exe 29 PID 2956 wrote to memory of 2308 2956 rundll32.exe 29 PID 2956 wrote to memory of 2308 2956 rundll32.exe 29 PID 2956 wrote to memory of 2308 2956 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf2b63991ec9ea28d93fb4b1b56fd32f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf2b63991ec9ea28d93fb4b1b56fd32f_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2308
-