Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 12:01
Behavioral task
behavioral1
Sample
JaffaCakes118_3f5d11c534f46563f67b9d00859d0795.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_3f5d11c534f46563f67b9d00859d0795.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_3f5d11c534f46563f67b9d00859d0795.dll
-
Size
112KB
-
MD5
3f5d11c534f46563f67b9d00859d0795
-
SHA1
7632a5be78debee76fbb925a895a98ea00425071
-
SHA256
41b622f760e96048c7e6944980406fa73f7e16d43caa3a01952c7059cdc731c8
-
SHA512
011e302fee5b31542eb06fbe2e0f9f81acfab79fdb6cb744570f3ac8e1a30b218769dc107474c8a2d1a778775bb1ab4bc0d6eb99111c95d18fc4b64282bf0d0b
-
SSDEEP
3072:V/zzAOkSOjr6vnVcrCMKZ32YVR+Frkq9wacyx:JGukCJgYjArkKwFU
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1928 968 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 968 rundll32.exe Token: SeRestorePrivilege 968 rundll32.exe Token: SeBackupPrivilege 968 rundll32.exe Token: SeRestorePrivilege 968 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2752 wrote to memory of 968 2752 rundll32.exe 83 PID 2752 wrote to memory of 968 2752 rundll32.exe 83 PID 2752 wrote to memory of 968 2752 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f5d11c534f46563f67b9d00859d0795.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f5d11c534f46563f67b9d00859d0795.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 6523⤵
- Program crash
PID:1928
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 968 -ip 9681⤵PID:3288