Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll
-
Size
132KB
-
MD5
4662f3edbf1eae668420dc4e48681820
-
SHA1
e665e27f2d1d73a4ccadfaee12344d53b16a8db0
-
SHA256
4e2c914de7a6374350a4be8fb76d0d25833518ad3b617e80a30865084e5e08ad
-
SHA512
2011b392d905a979cb34680d4fa8545171ed192ef6cd318a6060e8eb051e5c0bcac75ff85564acdfee232853495a15d0b71cf4d54a4f92b9a28f73e12df7bf7e
-
SSDEEP
3072:JDmtd2pmBHdyLGICkVM/iW21uD1QPdvQFkz2uAFdYVd:JKKpDabas1QlQFkCcd
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2608 3392 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 464 wrote to memory of 3392 464 rundll32.exe 84 PID 464 wrote to memory of 3392 464 rundll32.exe 84 PID 464 wrote to memory of 3392 464 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4662f3edbf1eae668420dc4e48681820_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 6163⤵
- Program crash
PID:2608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3392 -ip 33921⤵PID:4840