Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/01/2025, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_15afd7474e67c670eccb95ea356052e9.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_15afd7474e67c670eccb95ea356052e9.dll
-
Size
212KB
-
MD5
15afd7474e67c670eccb95ea356052e9
-
SHA1
4b5cfe87fa938639a1a9411908823479ab6fe4cd
-
SHA256
3f30d26b8e104e4c7b3bf2710a7ca8ac82c386e9f025bd868814240c6e304020
-
SHA512
e21bc5b97f688ede554685670bb076b421b1faadf28127c9f21b7fd73452b2daeaa0dcfe5050bb0b4b77a62cfcae82a2b04dbbaf1c24f7d7a735a57d50daf615
-
SSDEEP
3072:9dcQ2ZNMSQvbajUTUItjT68+xQoZZMPLItBjEWdvBQ0tM2:dATSOjUQKS/MzItzdvBQ0tT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2912 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 1948 rundll32.exe 1948 rundll32.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1548 2912 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1948 wrote to memory of 2912 1948 rundll32.exe 31 PID 1948 wrote to memory of 2912 1948 rundll32.exe 31 PID 1948 wrote to memory of 2912 1948 rundll32.exe 31 PID 1948 wrote to memory of 2912 1948 rundll32.exe 31 PID 2912 wrote to memory of 1548 2912 rundll32mgr.exe 32 PID 2912 wrote to memory of 1548 2912 rundll32mgr.exe 32 PID 2912 wrote to memory of 1548 2912 rundll32mgr.exe 32 PID 2912 wrote to memory of 1548 2912 rundll32mgr.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15afd7474e67c670eccb95ea356052e9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15afd7474e67c670eccb95ea356052e9.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 924⤵
- Loads dropped DLL
- Program crash
PID:1548
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5cd963c64ad0bea4ca85a4819f6eefed1
SHA1d9cd6316cf3c6ce5ceec9694c2debc7b7981775f
SHA25633c4b715dc8b183dff9aac65cc42c7f2c70658580b8e3d449878251482a5d906
SHA512f7cd12c57eff3acf7c89b0e7b55dfa81623618a65d6c49b490c199cfe63ae9e858f2681c8ef1425d1e4b25f7b0bbd6d4a9d9788956c23f52fece3d5d79b5907e