Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 10:40
Behavioral task
behavioral1
Sample
fa417e27034c3cf878703902de959c7b_JaffaCakes118.dll
Resource
win7-20240708-en
3 signatures
150 seconds
General
-
Target
fa417e27034c3cf878703902de959c7b_JaffaCakes118.dll
-
Size
101KB
-
MD5
fa417e27034c3cf878703902de959c7b
-
SHA1
b8e563ea254a179138eaebf023d9674b9ce2e1e5
-
SHA256
0bf7e73bedf38021d60d2bd5d01779b244c26ebd0d2a849bfe52ab5645c86bb2
-
SHA512
371badab92e60a89c88cda9996b1e3d55097fe65616bd387a24d8601614df8ae1a125aef71838ec539e6be8cd98a6b0837568e156c1fc3cc6603874a228f5d14
-
SSDEEP
1536:e8/mATyLDMEsXTzObdXefoJfPjTgCLUxosHe7j7YGUH3EbE+4HS8A:YwgIEcOnPjTgCwxXHyjEH3xA
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2340-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2340 2320 rundll32.exe 82 PID 2320 wrote to memory of 2340 2320 rundll32.exe 82 PID 2320 wrote to memory of 2340 2320 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa417e27034c3cf878703902de959c7b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa417e27034c3cf878703902de959c7b_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2340
-