Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll
-
Size
2KB
-
MD5
f699aea2da36c164f7e4bab119303a38
-
SHA1
cc7eeebf3aec78b5686d1167e77545ccd74324e4
-
SHA256
0464d984d39f73e6e4b241c9e1582595f08ee81d4b90f1d7025a4fc26a1703a0
-
SHA512
53d7741b835abf92c38169989907075130db415bdb1867d19147de960f3761ac27f6f648b8bf5915e09b04553833d2e187193b7cc170b4c32ce4d96c774c7e69
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe 2200 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2200 2236 rundll32.exe 30 PID 2236 wrote to memory of 2200 2236 rundll32.exe 30 PID 2236 wrote to memory of 2200 2236 rundll32.exe 30 PID 2236 wrote to memory of 2200 2236 rundll32.exe 30 PID 2236 wrote to memory of 2200 2236 rundll32.exe 30 PID 2236 wrote to memory of 2200 2236 rundll32.exe 30 PID 2236 wrote to memory of 2200 2236 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2200
-