Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
38ae862eb210968b0cb040ad35abadbf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
38ae862eb210968b0cb040ad35abadbf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/installhelper.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/installhelper.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/installhelper.dll
-
Size
22KB
-
MD5
dc7e5be0f621433274097da855086011
-
SHA1
ad59ef085650e554fb1b5ad61cd74cbb47027b0c
-
SHA256
929f7cfd7609328ec48c09e74506eb6b76eb3a7eed4c64973e3682930148299b
-
SHA512
13d58423b4191614bd0286623dc9c7083f4f169dc83a6fe2d16b43e050ca30115bfb1a895c116002eaaa3bde0c055410afa706d3ed22a29f3948346cd2929722
-
SSDEEP
384:MGnJQHg60w7nGSU3MgSEXasFkBDTs1WsMXT9tfyRlxLTgjGA1JXdDr:liA60wSSU8uXtkBXs1WsMXRtfefLTg6U
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30 PID 2876 wrote to memory of 2888 2876 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2888
-