Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 08:15
Static task
static1
Behavioral task
behavioral1
Sample
00596568a524cc376032b87762539a3c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00596568a524cc376032b87762539a3c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
00596568a524cc376032b87762539a3c_JaffaCakes118.dll
-
Size
308KB
-
MD5
00596568a524cc376032b87762539a3c
-
SHA1
819b24adb0c52e5ae80d8916ee0dcd8bf4d7cd1f
-
SHA256
6a85aa2135b3c01b40ad14f1b0bf18a20d2ae7aef41a770758ccaa2f9708e0c8
-
SHA512
c413bc15c2d6f1c557069ada9306553cd0d061f22b4bef269cc620dd69df7bb5b57f19ca65a6420adc55e828fae4b34bf0102d615a66743487bc0d34ec64163f
-
SSDEEP
6144:KKVgkqcV+ucRuedLk9KjP6BMGc+0vq5CY3WPApcfV8n1/6ajpOTBnu60AHq:skaucRuEkcjyq+bh68n1/djpOT5uyK
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2648 3024 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe 3024 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3024 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1604 wrote to memory of 3024 1604 rundll32.exe 89 PID 1604 wrote to memory of 3024 1604 rundll32.exe 89 PID 1604 wrote to memory of 3024 1604 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00596568a524cc376032b87762539a3c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00596568a524cc376032b87762539a3c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 6803⤵
- Program crash
PID:2648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3024 -ip 30241⤵PID:2216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4164,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:81⤵PID:3152