Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
ead0926482231518089117577d68fa9d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ead0926482231518089117577d68fa9d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ead0926482231518089117577d68fa9d_JaffaCakes118.dll
-
Size
18KB
-
MD5
ead0926482231518089117577d68fa9d
-
SHA1
4fb0f78a98644c79774d6074b1b009e9aa8950a1
-
SHA256
4237ecd29fc58a1470d7355a8c89d63726b9d0744d6ce077a97331d487134670
-
SHA512
5fb131325568c485c19ca49de54f269889dd2b581ca312209ff9cc454cb7f632af9cc3fb2374ef3e78e55219812477cab457fb80a347eed908d032f21a0230bc
-
SSDEEP
384:oRdCyiYMqlWjDmQq8uNOdA4JUw2BpW9zAzdeTg:8CycqlUDmQYF4J+BQ98d0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 664 wrote to memory of 2824 664 rundll32.exe 29 PID 664 wrote to memory of 2824 664 rundll32.exe 29 PID 664 wrote to memory of 2824 664 rundll32.exe 29 PID 664 wrote to memory of 2824 664 rundll32.exe 29 PID 664 wrote to memory of 2824 664 rundll32.exe 29 PID 664 wrote to memory of 2824 664 rundll32.exe 29 PID 664 wrote to memory of 2824 664 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ead0926482231518089117577d68fa9d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ead0926482231518089117577d68fa9d_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2824
-