Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 23:48
Static task
static1
Behavioral task
behavioral1
Sample
44c78a923b8de2fa2bdf9f7fc17f65bb_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
44c78a923b8de2fa2bdf9f7fc17f65bb_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
44c78a923b8de2fa2bdf9f7fc17f65bb_JaffaCakes118.dll
-
Size
9KB
-
MD5
44c78a923b8de2fa2bdf9f7fc17f65bb
-
SHA1
2c805215fb4e781304af05854153dc9af20005bc
-
SHA256
b40fed734718eb0f85c104600e76f8098ff44d08fa8b114efde37a121ce22254
-
SHA512
fab2cbc6ea5e81ff7324b2cff1472fc0bc4c4b7a31c5c712aacf7022219dc05fd43d88ceece67180c95f8745b93a537bdf62a1ed6908a05de2351c0a11c12fbb
-
SSDEEP
24:ev1GSmYJ9iD8osbecX+RGdJjUeTT7hbgON/zJzhnqbOIRNxkhaKRFL8pLNseaMAN:qhiY1+RCoqCONLJNqbOkaZZDhD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1628 2308 rundll32.exe 30 PID 2308 wrote to memory of 1628 2308 rundll32.exe 30 PID 2308 wrote to memory of 1628 2308 rundll32.exe 30 PID 2308 wrote to memory of 1628 2308 rundll32.exe 30 PID 2308 wrote to memory of 1628 2308 rundll32.exe 30 PID 2308 wrote to memory of 1628 2308 rundll32.exe 30 PID 2308 wrote to memory of 1628 2308 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44c78a923b8de2fa2bdf9f7fc17f65bb_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\44c78a923b8de2fa2bdf9f7fc17f65bb_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1628
-