Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
0b042705d5032077eae0a43a1ff39052_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b042705d5032077eae0a43a1ff39052_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0b042705d5032077eae0a43a1ff39052_JaffaCakes118.dll
-
Size
332KB
-
MD5
0b042705d5032077eae0a43a1ff39052
-
SHA1
cbbb73712e554af2a370b9c0a35d0c9992bd9941
-
SHA256
854350a804453da72f35d1c074a19ca8d593ed124194b2f1ee2e8046d2f786dc
-
SHA512
334c7b0273bd7fc62e6ff9d32bac1a01045fc243887d78d166ab15245c6e4f3d080c42115bb4336551fe8a911cdd4bda9035bacc09dff6cdb9bfab41ea92f58b
-
SSDEEP
6144:zhUwBgvehhkkkkckkkkbkkkhkkWkzIDvsssssssr:F4ve/kkkkckkkkbkkkhkkWJvsssssss
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\811sekaCaffaJ_25093ff1a34a0eae7702305d507240b0.pad rundll32.exe File opened for modification C:\PROGRA~3\811sekaCaffaJ_25093ff1a34a0eae7702305d507240b0.pad rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2740 1952 rundll32.exe 82 PID 1952 wrote to memory of 2740 1952 rundll32.exe 82 PID 1952 wrote to memory of 2740 1952 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b042705d5032077eae0a43a1ff39052_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b042705d5032077eae0a43a1ff39052_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2740
-