Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll
-
Size
132KB
-
MD5
4662f3edbf1eae668420dc4e48681820
-
SHA1
e665e27f2d1d73a4ccadfaee12344d53b16a8db0
-
SHA256
4e2c914de7a6374350a4be8fb76d0d25833518ad3b617e80a30865084e5e08ad
-
SHA512
2011b392d905a979cb34680d4fa8545171ed192ef6cd318a6060e8eb051e5c0bcac75ff85564acdfee232853495a15d0b71cf4d54a4f92b9a28f73e12df7bf7e
-
SSDEEP
3072:JDmtd2pmBHdyLGICkVM/iW21uD1QPdvQFkz2uAFdYVd:JKKpDabas1QlQFkCcd
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1748-5-0x0000000000180000-0x000000000018D000-memory.dmp upx behavioral1/memory/1748-9-0x0000000000180000-0x000000000018D000-memory.dmp upx behavioral1/memory/1748-7-0x0000000000180000-0x000000000018D000-memory.dmp upx behavioral1/memory/1748-6-0x0000000000180000-0x000000000018D000-memory.dmp upx behavioral1/memory/1748-4-0x0000000000180000-0x000000000018D000-memory.dmp upx behavioral1/memory/1748-1-0x0000000000180000-0x000000000018D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\0,2007 09:45:41) rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1748 2420 rundll32.exe 30 PID 2420 wrote to memory of 1748 2420 rundll32.exe 30 PID 2420 wrote to memory of 1748 2420 rundll32.exe 30 PID 2420 wrote to memory of 1748 2420 rundll32.exe 30 PID 2420 wrote to memory of 1748 2420 rundll32.exe 30 PID 2420 wrote to memory of 1748 2420 rundll32.exe 30 PID 2420 wrote to memory of 1748 2420 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:1748
-