Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/02/2025, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_d025a29d3fcf1ac56ba898b98f907980.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d025a29d3fcf1ac56ba898b98f907980.dll
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_d025a29d3fcf1ac56ba898b98f907980.dll
-
Size
1.7MB
-
MD5
d025a29d3fcf1ac56ba898b98f907980
-
SHA1
f952e386b3959ee5a1d6480910ee2e93be29bb8a
-
SHA256
a502930163e38bd44bc2c4c6d7a991880abea4437587c58313fc2f2f6fcb43da
-
SHA512
1546be601d35fb37d11a3a301563037d64cac1dde696c2ef4cb972ccd618d73a17487a601bdfa965d89f7b5b9c49bf499d8d60e03e16e9ed5dc501cd553bdd68
-
SSDEEP
49152:+GyOzzWWn/QDApct8O74W7y1mF9V/7eSSu4yk:+Gymzf/QEp4WmFv7eSS4k
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine rundll32.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2396 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2396 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2396 2364 rundll32.exe 31 PID 2364 wrote to memory of 2396 2364 rundll32.exe 31 PID 2364 wrote to memory of 2396 2364 rundll32.exe 31 PID 2364 wrote to memory of 2396 2364 rundll32.exe 31 PID 2364 wrote to memory of 2396 2364 rundll32.exe 31 PID 2364 wrote to memory of 2396 2364 rundll32.exe 31 PID 2364 wrote to memory of 2396 2364 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d025a29d3fcf1ac56ba898b98f907980.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d025a29d3fcf1ac56ba898b98f907980.dll,#12⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2396
-