Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
53c26bcb76627083b1980d0805f9a105_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
53c26bcb76627083b1980d0805f9a105_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
53c26bcb76627083b1980d0805f9a105_JaffaCakes118.dll
-
Size
69KB
-
MD5
53c26bcb76627083b1980d0805f9a105
-
SHA1
0285e0ce14bf80468cf8fd7139ed1c85f3709e53
-
SHA256
db11d10803205858371d6663db9237a6e74042079d7a66142eba9825ee3686b2
-
SHA512
73743f84d6e12312ac03ae3ba552f406c8c13ceb3d2963b899ea331e18ec02b61f2be10d557f427c4f8be2e6d737a9b7ed73fb7f771369b70f0374452e6307ba
-
SSDEEP
1536:x5iS5CnTTVW6rqzcuaV8o8vb/jVGdR/BvcsythUn7jVAuvSg1cHhkS8Rsw2tvx:x5VCnTTVW6rqzcrV8o8vb/jVGd1Jcntt
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2228 2692 rundll32.exe 30 PID 2692 wrote to memory of 2228 2692 rundll32.exe 30 PID 2692 wrote to memory of 2228 2692 rundll32.exe 30 PID 2692 wrote to memory of 2228 2692 rundll32.exe 30 PID 2692 wrote to memory of 2228 2692 rundll32.exe 30 PID 2692 wrote to memory of 2228 2692 rundll32.exe 30 PID 2692 wrote to memory of 2228 2692 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53c26bcb76627083b1980d0805f9a105_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53c26bcb76627083b1980d0805f9a105_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2228
-