Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
2e47b91e5cd2b3bcbb4fb1913a5d7e2c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2e47b91e5cd2b3bcbb4fb1913a5d7e2c_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2e47b91e5cd2b3bcbb4fb1913a5d7e2c_JaffaCakes118.dll
-
Size
26KB
-
MD5
2e47b91e5cd2b3bcbb4fb1913a5d7e2c
-
SHA1
5da37289311baac160c50c004f4cee2fb0e83a78
-
SHA256
72920fb283db2a8b2c688124ad994d61c25489c22dac375d5f0f4d1ab1e843d8
-
SHA512
752aeb7e7a1147d5a6d43653c7b611e35447f4b49ac21eded18873ebf02a9a33ebe852c5b0efe825b063987d7b8ff1e68a50d1b8b2645db3d7985c2a69c2975a
-
SSDEEP
768:bTRO9ZicEojES0KBQWK+CbcxFBoMjPxSoZV:blO9tzl0Eo9E3oMjLZV
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2820 2692 rundll32.exe 30 PID 2692 wrote to memory of 2820 2692 rundll32.exe 30 PID 2692 wrote to memory of 2820 2692 rundll32.exe 30 PID 2692 wrote to memory of 2820 2692 rundll32.exe 30 PID 2692 wrote to memory of 2820 2692 rundll32.exe 30 PID 2692 wrote to memory of 2820 2692 rundll32.exe 30 PID 2692 wrote to memory of 2820 2692 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e47b91e5cd2b3bcbb4fb1913a5d7e2c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e47b91e5cd2b3bcbb4fb1913a5d7e2c_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2820
-