Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 06:42
Behavioral task
behavioral1
Sample
04ba476b682f71ab2bcccaf3d2e564e5_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04ba476b682f71ab2bcccaf3d2e564e5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
04ba476b682f71ab2bcccaf3d2e564e5_JaffaCakes118.dll
-
Size
25KB
-
MD5
04ba476b682f71ab2bcccaf3d2e564e5
-
SHA1
9fecfc53d301621c1e13251a7d7129be42581a58
-
SHA256
b15e6880bde824074b36703c2df898feb9eec31762431251e69583c6c0a1e838
-
SHA512
57afec2a91d5264b992f6019f63428a54c5a39927d15ae810eae0cfbb2c63706d94a9cf6f70f03919324a5604e3792fe6082399a49869fbc8e6be53151e1d12d
-
SSDEEP
768:LOXHcZnC5NolgN0u7F7kXXXXXXXXXXf7XXXXXXXXXXW1XXXXXXXXXX4AXXXXXXXh:LOX8ZnC5No2d2imajEAQH
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3052 452 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3524 wrote to memory of 452 3524 regsvr32.exe 82 PID 3524 wrote to memory of 452 3524 regsvr32.exe 82 PID 3524 wrote to memory of 452 3524 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\04ba476b682f71ab2bcccaf3d2e564e5_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\04ba476b682f71ab2bcccaf3d2e564e5_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 6323⤵
- Program crash
PID:3052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 4521⤵PID:3064