Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
fefa42e2a6af8612f2839db4bd709228_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fefa42e2a6af8612f2839db4bd709228_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fefa42e2a6af8612f2839db4bd709228_JaffaCakes118.dll
-
Size
84KB
-
MD5
fefa42e2a6af8612f2839db4bd709228
-
SHA1
c318321543118db3906d8858503a48a818bade65
-
SHA256
ebffbcd242eabc1aa787dfb3ef34a5d4c80f4c76919c27c36ff3c8c9b38299af
-
SHA512
398cb8a1faf74cb335e52ba37037e6a590b1df8e1acd34e3aa1c891e6801d0da5b8cf1660365e768b4fff98388d15992f8ffae83637b927961911739547f37ec
-
SSDEEP
384:/eOU7+tsdISX03da1hLPFoY62vD61gbt6U+aHtWh0QBpK82GHH0py:/eQ2e1gJ+g4O8vU
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1756 wrote to memory of 964 1756 rundll32.exe 30 PID 1756 wrote to memory of 964 1756 rundll32.exe 30 PID 1756 wrote to memory of 964 1756 rundll32.exe 30 PID 1756 wrote to memory of 964 1756 rundll32.exe 30 PID 1756 wrote to memory of 964 1756 rundll32.exe 30 PID 1756 wrote to memory of 964 1756 rundll32.exe 30 PID 1756 wrote to memory of 964 1756 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fefa42e2a6af8612f2839db4bd709228_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fefa42e2a6af8612f2839db4bd709228_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:964
-