Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
28a21990d25b16d7bc192b62a6909fd6_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28a21990d25b16d7bc192b62a6909fd6_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
28a21990d25b16d7bc192b62a6909fd6_JaffaCakes118.dll
-
Size
752KB
-
MD5
28a21990d25b16d7bc192b62a6909fd6
-
SHA1
72d7ba1df0e095649f75594f1699db2301e59bf9
-
SHA256
6fbb05d4d4571d456807d9579e8d6852ef7d28d4ebe7f51fa0f58d4f0a3e1510
-
SHA512
f77276fdaa29766ea0132ce6d91f87d7dd22a0236bb3a676784918dcc8b8ad3057550108332e81664bd952281634ace3689dc0136fb5cf46898e72eed28ba4b5
-
SSDEEP
12288:lGk+L+4R8EqJluGF/JCyDLJkBGwAvK+1L:lGk+LPw3ZFxCyDLJks++5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5024 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4452 wrote to memory of 5024 4452 rundll32.exe 83 PID 4452 wrote to memory of 5024 4452 rundll32.exe 83 PID 4452 wrote to memory of 5024 4452 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28a21990d25b16d7bc192b62a6909fd6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28a21990d25b16d7bc192b62a6909fd6_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5024
-