Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 16:44
Behavioral task
behavioral1
Sample
dac94ef9216e9142f2e8e8f7e87f2e4c_JaffaCakes118.dll
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
dac94ef9216e9142f2e8e8f7e87f2e4c_JaffaCakes118.dll
-
Size
67KB
-
MD5
dac94ef9216e9142f2e8e8f7e87f2e4c
-
SHA1
681d2a71f13c640142b1c3339decaba9b053d3cb
-
SHA256
f92a19fdb1e410e4a06181b8e64328105a61fca5303ab684037b5a53c368055b
-
SHA512
5ffbe46f168a08025848a652f70e478376af813004e5a0f82a54f60e140eae14cd6d7bb422f7f3548308fb4c9f25b365b3f4cefb16f5d272165f59705ce66e33
-
SSDEEP
1536:kd0saUz+ATsM5Gr0jxdHEgeqAjsfrER6yCadDzVOhp3o3BmubBU:unTN5OGHuqacElCaREAmubBU
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2692-3-0x0000000010000000-0x000000001000E000-memory.dmp upx behavioral1/memory/2692-2-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2692 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2692 3020 rundll32.exe 30 PID 3020 wrote to memory of 2692 3020 rundll32.exe 30 PID 3020 wrote to memory of 2692 3020 rundll32.exe 30 PID 3020 wrote to memory of 2692 3020 rundll32.exe 30 PID 3020 wrote to memory of 2692 3020 rundll32.exe 30 PID 3020 wrote to memory of 2692 3020 rundll32.exe 30 PID 3020 wrote to memory of 2692 3020 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dac94ef9216e9142f2e8e8f7e87f2e4c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dac94ef9216e9142f2e8e8f7e87f2e4c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2692
-