Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 13:24
Behavioral task
behavioral1
Sample
e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll
-
Size
11KB
-
MD5
e78e8879aa3602eb81bdc473a14e6d29
-
SHA1
8f9788c6169fe8940423f2a3807ed90f9138d538
-
SHA256
a8fe9d8109f0da2736e3c7a6fb5e98b29f834725a52da301d0cac2dc841542e3
-
SHA512
ae0f665b526adab1619f22ac245b827c0358ec6cf5c8d946f39034af6baf51edfc3ebd0d9dcc0c2c7de0d04915a23044b0e3d99851e6e2451ec2d0f883d611b7
-
SSDEEP
192:nr4h1oj/ed/ma5dFpbXRO71NXXn+Y+uZSFlFnQ3pLy4RL2c1sdqixmOMfczAL:UjorUm8iNHn+80Uy4N2z1AY
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3200-0-0x0000000000560000-0x000000000056E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3244 wrote to memory of 3200 3244 rundll32.exe 86 PID 3244 wrote to memory of 3200 3244 rundll32.exe 86 PID 3244 wrote to memory of 3200 3244 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e78e8879aa3602eb81bdc473a14e6d29_JaffaCakes118.dll,#12⤵PID:3200
-