Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 06:22
Static task
static1
Behavioral task
behavioral1
Sample
3e47664855a75c1e5366af4a76f89d70_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3e47664855a75c1e5366af4a76f89d70_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3e47664855a75c1e5366af4a76f89d70_JaffaCakes118.dll
-
Size
3KB
-
MD5
3e47664855a75c1e5366af4a76f89d70
-
SHA1
e61807f8f98b04787b671725ff57b44d592c9414
-
SHA256
bbb8942fc2fac4b4785173105f9bf863d035420d679cc4181c0e421d6c8674b3
-
SHA512
d79d03799846231a0def0238b311a82bed3fe3077794c9045a6b2d41d1ad71f861583643472f882f256f297886370333344a4bf01eb87c343069eeb0698e2fbf
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2804 wrote to memory of 4220 2804 rundll32.exe 83 PID 2804 wrote to memory of 4220 2804 rundll32.exe 83 PID 2804 wrote to memory of 4220 2804 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e47664855a75c1e5366af4a76f89d70_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e47664855a75c1e5366af4a76f89d70_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4220
-