Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll
-
Size
752KB
-
MD5
54f976278d9dc06fab5251a87d10f195
-
SHA1
5f879fc1ada50704d8a58f2613295e48cffea5ec
-
SHA256
aafa481b41f2b8c1e617accf28b7fd5d5a5dd1fc86b95d53cec40582e84f4d3e
-
SHA512
801ea748e0da0d04257a7dc7cb647e4f61ccdb08da8d12d08d0166da4baec1105f4634ec7f4f67d10bd01a0c9c2072dbbee8f2495f6ab2bac7ea449671a5d8dd
-
SSDEEP
6144:mVGryRrIMtoTf4uJiQDrJGHcFl6G6wlRhwjSNL4SMcvTp/47EnfJoSCUyYz7U/C:mgryRrI/Tfw2JecFl6GvRGC1eEx4K
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4524 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3308 wrote to memory of 4524 3308 rundll32.exe 86 PID 3308 wrote to memory of 4524 3308 rundll32.exe 86 PID 3308 wrote to memory of 4524 3308 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4524
-