Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 12:32
Behavioral task
behavioral1
Sample
0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll
Resource
win7-20240708-en
3 signatures
150 seconds
General
-
Target
0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll
-
Size
27KB
-
MD5
0aae18d03bccc07e326165fe106faf94
-
SHA1
503a4cbb0b0829b9ab25c331b81d85fd2b0e383e
-
SHA256
f321707f4b46bcd16dd5e774cc80a064137d315eee07909b5f8096d451d36e68
-
SHA512
c2402338a7aa6921507cdc725c931faba387f1b40c03f5d91dd067cbbcfe5dc2073383f7d61d2a6b052f8168b0e4d623b4dd9cc32ed730c2b5d6565893dd532d
-
SSDEEP
768:nStC5ER3RwrEhrvbO4r0DLVXQThRTlXA4A4i4UOC8:nSLRIERzOBVuTo/8
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2332-0-0x0000000010000000-0x0000000010011000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3936 wrote to memory of 2332 3936 rundll32.exe 82 PID 3936 wrote to memory of 2332 3936 rundll32.exe 82 PID 3936 wrote to memory of 2332 3936 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2332
-