Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 13:02
Static task
static1
Behavioral task
behavioral1
Sample
18333279d1570e19675f3cd1a1b3c350_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
18333279d1570e19675f3cd1a1b3c350_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
18333279d1570e19675f3cd1a1b3c350_JaffaCakes118.dll
-
Size
224KB
-
MD5
18333279d1570e19675f3cd1a1b3c350
-
SHA1
70203aab730e26f7235bfa0c2c77a4045d604d85
-
SHA256
0b094db89af1cf2d7749be3c7715a32a98e75777c1ae613d72c0a2eb4d0a6855
-
SHA512
3915fe59a39bc716dad24be289ab0bd8dcee153491ec8dace171ab360971f7a70533ad8d902703c98bc2d4f05d354b7cf5746e9806b3862ca783087f61aad465
-
SSDEEP
3072:sVp2CPdvNpScUXiPJFbQ9rjELPR2ouozv5:op2CPdlpScUXsDhPR2oh5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2788 2784 rundll32.exe 30 PID 2784 wrote to memory of 2788 2784 rundll32.exe 30 PID 2784 wrote to memory of 2788 2784 rundll32.exe 30 PID 2784 wrote to memory of 2788 2784 rundll32.exe 30 PID 2784 wrote to memory of 2788 2784 rundll32.exe 30 PID 2784 wrote to memory of 2788 2784 rundll32.exe 30 PID 2784 wrote to memory of 2788 2784 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\18333279d1570e19675f3cd1a1b3c350_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\18333279d1570e19675f3cd1a1b3c350_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2788
-