Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll
-
Size
70KB
-
MD5
ea9fddbb29d9fde653f387b782bf42f5
-
SHA1
d11525218e35067ccf5d426c01cf323253d29dcf
-
SHA256
8e2d347213576a7c2f1a398013a62ade61bd001e9d1a1535e33f5fc810344638
-
SHA512
9399ac830779bcae1d9dd6e7795f65681ab37c9754685e55236ca7188a2e6bdea86048329ce57843c592c40449f4ef78d4cbee7f4bce699a766ad410d2b3a30e
-
SSDEEP
1536:WrRQtfuQCsB9wSuiRHmIL3eoMLQt1aWgDa2cOf94bMg2BzUT:ykm+GdiRHmI6oM21aFDa3Of9Q2BS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5068 wrote to memory of 2896 5068 rundll32.exe 85 PID 5068 wrote to memory of 2896 5068 rundll32.exe 85 PID 5068 wrote to memory of 2896 5068 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea9fddbb29d9fde653f387b782bf42f5_JaffaCakes118.dll,#12⤵PID:2896
-