Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
167b463cf117d02219af922ce7e19c15_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
167b463cf117d02219af922ce7e19c15_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
167b463cf117d02219af922ce7e19c15_JaffaCakes118.dll
-
Size
124KB
-
MD5
167b463cf117d02219af922ce7e19c15
-
SHA1
4af04d0c159c651d3f5266b3e46a664d9cb8b844
-
SHA256
6e0647563e11ef2173962f88f547c0ef5fc6c3805713cb2df8b138a990dbcbb2
-
SHA512
81b7b4ca76f163e765116ec29262de2d2abcf85d9fceb307fe3ec2c95b43b8f476fc65a351b9c3cb313390197decfa8bde3b137d16780559ca9ff2e2fda1c7f7
-
SSDEEP
3072:v/52cSj1+PQahVfec0Ts/5Fa/rpGgvzro7:xs+XT/0Ts/5FFgvS
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4724 4856 rundll32.exe 82 PID 4856 wrote to memory of 4724 4856 rundll32.exe 82 PID 4856 wrote to memory of 4724 4856 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\167b463cf117d02219af922ce7e19c15_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\167b463cf117d02219af922ce7e19c15_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4724
-