Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 04:45 UTC
Static task
static1
Behavioral task
behavioral1
Sample
dbd4fcc76e613b8b2405a650e203fa8d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbd4fcc76e613b8b2405a650e203fa8d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dbd4fcc76e613b8b2405a650e203fa8d_JaffaCakes118.dll
-
Size
101KB
-
MD5
dbd4fcc76e613b8b2405a650e203fa8d
-
SHA1
aabbf8ced10c27199900bf8a36bba5af1afaebc9
-
SHA256
af819f1ad946300f87d73e94ce4e51c912dfd83fc3b0baf7b730b3dd41f8754a
-
SHA512
595b57c59b41a91509ebbe0b46e3a1648e0fd5ab8d08d94c3472d4e26db2c0d34fd169e6e4e64956da9f5024c4a652db49bcad0ff181b0987420308b01758cbd
-
SSDEEP
1536:XA97ibpK+pYK+pKrJIVX65OA6eNyRn68LE9:XAJiFK+KK+QrJIVXs/yRn68LE9
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 544 4308 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2376 wrote to memory of 4308 2376 rundll32.exe 83 PID 2376 wrote to memory of 4308 2376 rundll32.exe 83 PID 2376 wrote to memory of 4308 2376 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbd4fcc76e613b8b2405a650e203fa8d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbd4fcc76e613b8b2405a650e203fa8d_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 6003⤵
- Program crash
PID:544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4308 -ip 43081⤵PID:5096
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
25.140.123.92.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
31.243.111.52.in-addr.arpa