Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 18:33
Behavioral task
behavioral1
Sample
JaffaCakes118_427daaddb8069e002d9e9825f9bb8930.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_427daaddb8069e002d9e9825f9bb8930.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_427daaddb8069e002d9e9825f9bb8930.dll
-
Size
113KB
-
MD5
427daaddb8069e002d9e9825f9bb8930
-
SHA1
5de3d45c59d696e55b6da9540c1359ff8bbf3c63
-
SHA256
3f47ec7d7991e0c6f6c5ba2dca4f323d9edbe31b22e723abe34e6e2cbff3028b
-
SHA512
216e62c79fdebe4b4b64f87062092765a9830cbb1453b557f60779bb54de81e8ff5c13511ac9e8518b6bd5a5564dc7b40a6d47320ee69817fdd43b5aa883adc1
-
SSDEEP
1536:eaoRaXQs7+9AlA5CeUX1GFo6Uz+cQZL3f8bU0j1aYYOUj79kWvay3:loRy7+IickUz+LZLv8bUlYXUj79kWva
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2864 2708 rundll32.exe 31 PID 2708 wrote to memory of 2864 2708 rundll32.exe 31 PID 2708 wrote to memory of 2864 2708 rundll32.exe 31 PID 2708 wrote to memory of 2864 2708 rundll32.exe 31 PID 2708 wrote to memory of 2864 2708 rundll32.exe 31 PID 2708 wrote to memory of 2864 2708 rundll32.exe 31 PID 2708 wrote to memory of 2864 2708 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_427daaddb8069e002d9e9825f9bb8930.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_427daaddb8069e002d9e9825f9bb8930.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2864
-