Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
fbdb9f36acb1a6e0abb283d09ef21912_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fbdb9f36acb1a6e0abb283d09ef21912_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fbdb9f36acb1a6e0abb283d09ef21912_JaffaCakes118.dll
-
Size
90KB
-
MD5
fbdb9f36acb1a6e0abb283d09ef21912
-
SHA1
21c7cdce08d9f18f1bee252da909b57078a17e14
-
SHA256
27fa59c8a226027e1494b9d91f6e30333d701c6ceca355538e9da86349252420
-
SHA512
a710be4fe0b23ce8247a1075a70d183db2ceaf3fa975b1ac58f49ead1f0caa60f02cfeefea00421e5f85dd6c8a67ff5b6a8671185ef3c2faf813a216c662aed6
-
SSDEEP
1536:pMyRA59WdP9SGSEtgc2YgIcST5bRn/oNDsu9LAHfij9h3o:DR+9WdP9SMtgc2dSTBx/oN/LEi3o
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2744 2180 rundll32.exe 30 PID 2180 wrote to memory of 2744 2180 rundll32.exe 30 PID 2180 wrote to memory of 2744 2180 rundll32.exe 30 PID 2180 wrote to memory of 2744 2180 rundll32.exe 30 PID 2180 wrote to memory of 2744 2180 rundll32.exe 30 PID 2180 wrote to memory of 2744 2180 rundll32.exe 30 PID 2180 wrote to memory of 2744 2180 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbdb9f36acb1a6e0abb283d09ef21912_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fbdb9f36acb1a6e0abb283d09ef21912_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2744
-