Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll
-
Size
476KB
-
MD5
f5e86ffacb65dcda5e425a5235018bb0
-
SHA1
5350e5dc510ae2d395e96f036de57159d1a2c5f7
-
SHA256
52599d76fe2b8f6cdcf5a32a5e78374e16fb86969097c23c2f531b73eacb624d
-
SHA512
30edec9295eda52f53dff172c6fa6875d9cb192a10fd902b7070534dad0795a582a9286aa6fbaf4169464dcc610be36642493e122e962893503a4d477d66494a
-
SSDEEP
6144:TUw5etIDfEBJ1hel9AiYUdKsdyq1vR6sMr1X5r33fLRbhn7X5aX+pvQU2H:TUoetgIJ1hh0dhJgrJdvDU+T2
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 5 2720 rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll\",watch" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll_xserve = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll\",xserve" rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe 2140 rundll32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 1716 wrote to memory of 2124 1716 rundll32.exe 28 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2140 2124 rundll32.exe 29 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30 PID 2124 wrote to memory of 2720 2124 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll,#12⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll",watch3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2140
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\f5e86ffacb65dcda5e425a5235018bb0_JaffaCakes118.dll",xserve3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2720
-
-