Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 21:25
Static task
static1
Behavioral task
behavioral1
Sample
d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll
-
Size
56KB
-
MD5
d2de4c3e825eb1b94d9319658c75ee35
-
SHA1
382b51e9d7436dd69fbcdae77d0577909c08687d
-
SHA256
dc961018fdd3b3ae03c3f3aeddd51d1dcf533b7cf86c4a27ace4f817c6f7f1b7
-
SHA512
2720ee83ffe217ec5f550512f5165d6e2ebd1003334b359f3dfb89df4c3597d87c3ea8f7ae7955152f5fe70446ad049f814f9fbb7cbc8b2214faad08e2becbdf
-
SSDEEP
1536:0+ItgAg0Y+WiABVQohIpNhqCdP84iODD7a8CTb:YeAm+WiABeohIpNnva8CTb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1932 1964 rundll32.exe 30 PID 1964 wrote to memory of 1932 1964 rundll32.exe 30 PID 1964 wrote to memory of 1932 1964 rundll32.exe 30 PID 1964 wrote to memory of 1932 1964 rundll32.exe 30 PID 1964 wrote to memory of 1932 1964 rundll32.exe 30 PID 1964 wrote to memory of 1932 1964 rundll32.exe 30 PID 1964 wrote to memory of 1932 1964 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1932
-