Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
d95f2cf3f4199ce3dd595b24e676a073_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d95f2cf3f4199ce3dd595b24e676a073_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d95f2cf3f4199ce3dd595b24e676a073_JaffaCakes118.dll
-
Size
330KB
-
MD5
d95f2cf3f4199ce3dd595b24e676a073
-
SHA1
6eec02f14a5ffeda4b1f972193573954b61ba8f6
-
SHA256
6f8d22cb02a962f21d0f0266b761b39696ab9cea8abb71af2e4963a6575f7bf2
-
SHA512
c8235d0137ad020e361295f4a19093d12f20279091baa032a3d2e1d811dab9ec19a189d623eb25f6767147eac78c5fb3deba74c8787f81a18f85167c2e27dc18
-
SSDEEP
3072:XRq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Bq1sFAwgwmBv3wnIgG4oAYxvU54eu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4900 4560 rundll32.exe 90 PID 4560 wrote to memory of 4900 4560 rundll32.exe 90 PID 4560 wrote to memory of 4900 4560 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d95f2cf3f4199ce3dd595b24e676a073_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d95f2cf3f4199ce3dd595b24e676a073_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4376,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:81⤵PID:4956