Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 22:47
Static task
static1
Behavioral task
behavioral1
Sample
ea1cf1882be040772fbdc279712d2944_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
ea1cf1882be040772fbdc279712d2944_JaffaCakes118.dll
-
Size
31KB
-
MD5
ea1cf1882be040772fbdc279712d2944
-
SHA1
0a330033517ab71be9d74e961dd35eae77196f06
-
SHA256
a3638f0c01c47a1906dfd8a86b9e747075464231109521a071129436777a4aab
-
SHA512
2d176901368360fd0b4372f304a69e017b49b99d9b8997ec15ebce64414252f5263cfe65b6aebfca9ac50f10bcb36bf7e26c8bb61d0e4978f165d640de1fc825
-
SSDEEP
768:wXL+nlX2TIwFdwrNqyl/p7la9TxII4fGytcn1jyeDSIWDBzBz:wb4mTPIpqyr7IFx8onBfSIWlzBz
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2256 2956 rundll32.exe 30 PID 2956 wrote to memory of 2256 2956 rundll32.exe 30 PID 2956 wrote to memory of 2256 2956 rundll32.exe 30 PID 2956 wrote to memory of 2256 2956 rundll32.exe 30 PID 2956 wrote to memory of 2256 2956 rundll32.exe 30 PID 2956 wrote to memory of 2256 2956 rundll32.exe 30 PID 2956 wrote to memory of 2256 2956 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea1cf1882be040772fbdc279712d2944_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea1cf1882be040772fbdc279712d2944_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2256
-