Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 12:16
Behavioral task
behavioral1
Sample
180c521766869132df5edc41f5938eb7_JaffaCakes118.dll
Resource
win7-20240903-en
3 signatures
150 seconds
General
-
Target
180c521766869132df5edc41f5938eb7_JaffaCakes118.dll
-
Size
54KB
-
MD5
180c521766869132df5edc41f5938eb7
-
SHA1
f7c347d56ddc4109f35027cebdb21fd96202b49a
-
SHA256
2e416f8dc25f3e48e79c0147facba983ac1e442a1cc1ac1dcf057b39898debe9
-
SHA512
7aef08e00635173609ef9ff1a158e02f7c88bb7eff8fa20d400eacc39d3321bf28b1f576b24a7b40135769f9e7232276837823459043a449f0d18e51130cf9b3
-
SSDEEP
768:eBgNHK3ObAv/0MNjjh4F5Fc+qKLjJ/BYb3idsVg3Dgmx2QQ1jnKnIkJTzycRLcVX:v9kvc4uLkKAssVg3DgQ5Q1jn4PDiVbr
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3672-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1844 wrote to memory of 3672 1844 rundll32.exe 82 PID 1844 wrote to memory of 3672 1844 rundll32.exe 82 PID 1844 wrote to memory of 3672 1844 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\180c521766869132df5edc41f5938eb7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\180c521766869132df5edc41f5938eb7_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3672
-