Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 21:25
Static task
static1
Behavioral task
behavioral1
Sample
d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll
-
Size
56KB
-
MD5
d2de4c3e825eb1b94d9319658c75ee35
-
SHA1
382b51e9d7436dd69fbcdae77d0577909c08687d
-
SHA256
dc961018fdd3b3ae03c3f3aeddd51d1dcf533b7cf86c4a27ace4f817c6f7f1b7
-
SHA512
2720ee83ffe217ec5f550512f5165d6e2ebd1003334b359f3dfb89df4c3597d87c3ea8f7ae7955152f5fe70446ad049f814f9fbb7cbc8b2214faad08e2becbdf
-
SSDEEP
1536:0+ItgAg0Y+WiABVQohIpNhqCdP84iODD7a8CTb:YeAm+WiABeohIpNnva8CTb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3172 wrote to memory of 708 3172 rundll32.exe 83 PID 3172 wrote to memory of 708 3172 rundll32.exe 83 PID 3172 wrote to memory of 708 3172 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2de4c3e825eb1b94d9319658c75ee35_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:708
-