Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 05:30
Behavioral task
behavioral1
Sample
d5b9677f6cbf98883329a96652fd950d_JaffaCakes118.dll
Resource
win7-20240704-en
3 signatures
150 seconds
General
-
Target
d5b9677f6cbf98883329a96652fd950d_JaffaCakes118.dll
-
Size
98KB
-
MD5
d5b9677f6cbf98883329a96652fd950d
-
SHA1
158927179e3680591e86988931b4a34ebe1e88ad
-
SHA256
955c21f491d3d6c33956d054570c308f3ca919be9e7c3e0e5e1f780fc9b742a5
-
SHA512
cec3974c18e666699acc923e104decbd236d06df384cfaa11898c61d6d8061d00b6768e3430cb170778432698bb42162c2ff82fe254d93df1a20bc01c6503e24
-
SSDEEP
3072:0RBNXdAK87xbMdlnF2wFcRkdp4Lrs+ca+o+31vMbj:0RBBdBibMdP2wOLrs+1+oC1Ebj
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4772-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2780 wrote to memory of 4772 2780 rundll32.exe 83 PID 2780 wrote to memory of 4772 2780 rundll32.exe 83 PID 2780 wrote to memory of 4772 2780 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5b9677f6cbf98883329a96652fd950d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5b9677f6cbf98883329a96652fd950d_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4772
-