Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 16:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_5bfa27ec850d0d8188ad4049a1c359f0.dll
Resource
win7-20240903-en
2 signatures
150 seconds
General
-
Target
JaffaCakes118_5bfa27ec850d0d8188ad4049a1c359f0.dll
-
Size
330KB
-
MD5
5bfa27ec850d0d8188ad4049a1c359f0
-
SHA1
53e091a822a60d207ba22706d7f02a968a9c648e
-
SHA256
c2372d2a771b3f9a393ec6a35bd222df79e4f25f979d09868e47827b6e7b32fa
-
SHA512
4b397aa6b7e0ba0f3ac3d052078cf80de2d97b3549e81a508c402fecabd042eb8a18fa63aaf81b820cf44590cdf0e0eee851eb2a9a3d54c800312360b3efee82
-
SSDEEP
6144:fMJOWK4lfwqOVq1LBNX+3iCPYwgThyYAwJ9/0Pf:f2OWK4lYGO3iCPYJ9PAA9U
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 540 wrote to memory of 1672 540 rundll32.exe 31 PID 540 wrote to memory of 1672 540 rundll32.exe 31 PID 540 wrote to memory of 1672 540 rundll32.exe 31 PID 540 wrote to memory of 1672 540 rundll32.exe 31 PID 540 wrote to memory of 1672 540 rundll32.exe 31 PID 540 wrote to memory of 1672 540 rundll32.exe 31 PID 540 wrote to memory of 1672 540 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bfa27ec850d0d8188ad4049a1c359f0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5bfa27ec850d0d8188ad4049a1c359f0.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1672
-