Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll
-
Size
224KB
-
MD5
fd4c8104720902c41c71e7ee5a26d12f
-
SHA1
4cd4e8af15156142a30349d31c3d4f8efeb29c2a
-
SHA256
c7798b02a51afb96e02b17c311a6bc12203bcd6f5cd9916f508a5af7c72fc537
-
SHA512
ae24e376082b02c0601a5132d4569bef37d891f9889d1537c6c41e52ed6fb4f236fe514da145d2d4fb1d648e2a4b2b986fcb976c0fc69ac38fc6d939ab9c2b24
-
SSDEEP
3072:3GC6/rjVwMRbySii1O2s/+lVlgY/InIFQHxHNvK4sdkBrxj+RuozzwnJSfD0Mc:o/ryYbKivtBgIInFpNv6kBNjafcSft
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1872 wrote to memory of 660 1872 rundll32.exe 30 PID 1872 wrote to memory of 660 1872 rundll32.exe 30 PID 1872 wrote to memory of 660 1872 rundll32.exe 30 PID 1872 wrote to memory of 660 1872 rundll32.exe 30 PID 1872 wrote to memory of 660 1872 rundll32.exe 30 PID 1872 wrote to memory of 660 1872 rundll32.exe 30 PID 1872 wrote to memory of 660 1872 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:660
-