Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
da80bec35ccb9685c1a7136fa974e948_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da80bec35ccb9685c1a7136fa974e948_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
da80bec35ccb9685c1a7136fa974e948_JaffaCakes118.dll
-
Size
76KB
-
MD5
da80bec35ccb9685c1a7136fa974e948
-
SHA1
9532729c67bd648db858a41a614ca6d5b210aa18
-
SHA256
02343c137b7be5188c767fce04f36315b354ac831dc2a2f55638bea89066e50f
-
SHA512
7a3cd368d5dfb28fde0b7e42912692ec62e5ad83d0c83b204f93f633b06ce58d6077aa5790f71a952af6a11617894ef59079738d63dd40c1f47eba984eee00dd
-
SSDEEP
1536:ZrWC9MmPFKAAvbVdWQC4rQIKLeH+DBykVLtZ1XrLKdnld:ZrWC9x0XvhlNrQIK8AMkVLLF/Kdld
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3516 2568 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3148 wrote to memory of 2568 3148 rundll32.exe 83 PID 3148 wrote to memory of 2568 3148 rundll32.exe 83 PID 3148 wrote to memory of 2568 3148 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da80bec35ccb9685c1a7136fa974e948_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\da80bec35ccb9685c1a7136fa974e948_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 5483⤵
- Program crash
PID:3516
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2568 -ip 25681⤵PID:1564