Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll
-
Size
84KB
-
MD5
eae1127e600b1d267f7770af627e59a2
-
SHA1
7d27e7681772eb19f38e403325fd9620a9806bd1
-
SHA256
f8061094f878bdd90830649682983c5281d68c30f9e411e50761b85347e9d90c
-
SHA512
a82dfdc44672a240f177dd4598e62cdf5820d40a7fd007f982984b578cc00b2462eb3956e1e2f02b7630f08cd9684eb998abcb6ff7dfd9861a043f3701032d28
-
SSDEEP
1536:niK5yS2vFYmUSKvSLnY1YqF31MPfpAzLjnY1Y:niK5TK5UScSkH31Wwc
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30 PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30 PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30 PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30 PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30 PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30 PID 2932 wrote to memory of 3020 2932 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\eae1127e600b1d267f7770af627e59a2_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:3020
-