Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 09:07
Behavioral task
behavioral1
Sample
fa1e8519923c7f451d4bdb52f9d66299_JaffaCakes118.dll
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
fa1e8519923c7f451d4bdb52f9d66299_JaffaCakes118.dll
-
Size
876KB
-
MD5
fa1e8519923c7f451d4bdb52f9d66299
-
SHA1
ec997e0c286515343b272c3fe819ef8b33feadbb
-
SHA256
97fabec1866ef957e19ecb6ab4edfd91dad70eac456f82928b3913a0e0e7b853
-
SHA512
da17a9f34c8ea7d31baff91a764dd7b4f51de2aa8650b17f5ed1c8184cdf4d2540279288f169e27e6d5c13820660832d17f1e9fc9c46f45b58a9487013b96cca
-
SSDEEP
24576:n/ZjUSFX/EkhV6XPGoDWoSjEI1O41pVLipWOJF:/HV6OoDU1RQpWA
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2444-0-0x0000000000400000-0x00000000006A0000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 4204 2444 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2444 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2444 2548 rundll32.exe 89 PID 2548 wrote to memory of 2444 2548 rundll32.exe 89 PID 2548 wrote to memory of 2444 2548 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1e8519923c7f451d4bdb52f9d66299_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa1e8519923c7f451d4bdb52f9d66299_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 6083⤵
- Program crash
PID:4204
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2444 -ip 24441⤵PID:4964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:81⤵PID:4664