Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
dcaa65241fec41c8645d11758d550ef3_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcaa65241fec41c8645d11758d550ef3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dcaa65241fec41c8645d11758d550ef3_JaffaCakes118.dll
-
Size
33KB
-
MD5
dcaa65241fec41c8645d11758d550ef3
-
SHA1
a9c9c5ebbd551278aeedfa01ac36f3e3877a696b
-
SHA256
36cc985bc220d118100ec02dcfdda5159bc277aed196a02376b1248c5f3f36a7
-
SHA512
e68e307207909488fb862cae2c3c3436e3562d7ee3f8874655237c81f288f00be31aaccf52643a61c6dad21e13e4f7f46154ea5c931b5482a626ff0558beabae
-
SSDEEP
768:vIoikqZOiQ1GrIHFpucpt2zZ3quJLrVN4R/a3EtCQ:vIvkqZnQ1ZFplW6ux4RM2CQ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2748 628 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 1940 wrote to memory of 628 1940 rundll32.exe 31 PID 628 wrote to memory of 2748 628 rundll32.exe 32 PID 628 wrote to memory of 2748 628 rundll32.exe 32 PID 628 wrote to memory of 2748 628 rundll32.exe 32 PID 628 wrote to memory of 2748 628 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dcaa65241fec41c8645d11758d550ef3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dcaa65241fec41c8645d11758d550ef3_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 2363⤵
- Program crash
PID:2748
-
-