Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 10:12
Behavioral task
behavioral1
Sample
e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll
-
Size
61KB
-
MD5
e9c18497459ff65e267d64a176154cc8
-
SHA1
653967ee92c546d95bb35f118c4070b8945ce6fb
-
SHA256
72ba051e41843be3b9565854d938d2ef9aa784b3b32dbbbceb636c38562a2f00
-
SHA512
62606a527803d78924f5ed6bd4c34198b05fb81af75c52a3fe05c1dced0b2437a584071d094d4effc0d337983faabf6e27d5394911b95b3b46497b6a83514e28
-
SSDEEP
1536:V2bs2YswRxGLpZMClcaDB7bB7pvRChVQj:WzJIG1ZMCl3V7bFpvRCO
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3996-0-0x0000000010000000-0x000000001000A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4460 wrote to memory of 3996 4460 rundll32.exe 93 PID 4460 wrote to memory of 3996 4460 rundll32.exe 93 PID 4460 wrote to memory of 3996 4460 rundll32.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c18497459ff65e267d64a176154cc8_JaffaCakes118.dll,#12⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:5012