Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
dd8071214fca71b7ae65f8746e33e590_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd8071214fca71b7ae65f8746e33e590_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dd8071214fca71b7ae65f8746e33e590_JaffaCakes118.dll
-
Size
8KB
-
MD5
dd8071214fca71b7ae65f8746e33e590
-
SHA1
0d8299824b8d1045ff4ed8dc3b20cffceac8daa5
-
SHA256
dc3af8d0e7e032be2caf6852854cd48c47ff4d54b87bebabc0a459c6ee12cf37
-
SHA512
76751550a85a69cf0395ebea5c59eb0f2ed0af743267536ee3e31af4a9424e1b31e9efa334d8b71970594fc74fd61857f8d991b529cddbe5e62b49887158d4e0
-
SSDEEP
192:D5YK+IcAVxM4yCYWpIFXhDJzHmgAZHXQEoRQ/k+22gyTQvixUkgUwu:O9Icq8CYWpIxjzHnAURQ/o2mvixr
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}\InprocServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABD0935D-B35A-47BD-BA9A-81678DDE74DD} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dd8071214fca71b7ae65f8746e33e590_JaffaCakes118.dll" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3496 rundll32.exe 3496 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4556 wrote to memory of 3496 4556 rundll32.exe 85 PID 4556 wrote to memory of 3496 4556 rundll32.exe 85 PID 4556 wrote to memory of 3496 4556 rundll32.exe 85 PID 3496 wrote to memory of 3424 3496 rundll32.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8071214fca71b7ae65f8746e33e590_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd8071214fca71b7ae65f8746e33e590_JaffaCakes118.dll,#13⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496
-
-