Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 02:11
Behavioral task
behavioral1
Sample
ec752261828b01df7b4c75d4068e3809_JaffaCakes118.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec752261828b01df7b4c75d4068e3809_JaffaCakes118.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
ec752261828b01df7b4c75d4068e3809_JaffaCakes118.dll
-
Size
66KB
-
MD5
ec752261828b01df7b4c75d4068e3809
-
SHA1
a11356e97d08b3d7e3611de45859237f25bfee77
-
SHA256
740ab08f23e01f0adffed82f9dac4dfa71e9267e86831ed87d9ffad0e76f2cbb
-
SHA512
43c0638f600bca00fafc9de300b2c6cd7d53054087415f98217d1cd3d04d3225d47299fdea451ae0dad447bf885fa90ae68901f864f6e9eceb4857a73e8ac315
-
SSDEEP
1536:yl3E0TDoZWWv48qy/JkMp+r1EMRnQxrOcfpXEDcBQ9bxvoJw:E39P+FSMkrvRnQpOcfpXEIB0dcw
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2228-1-0x0000000010000000-0x000000001000E000-memory.dmp upx behavioral1/memory/2228-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2228 2352 rundll32.exe 28 PID 2352 wrote to memory of 2228 2352 rundll32.exe 28 PID 2352 wrote to memory of 2228 2352 rundll32.exe 28 PID 2352 wrote to memory of 2228 2352 rundll32.exe 28 PID 2352 wrote to memory of 2228 2352 rundll32.exe 28 PID 2352 wrote to memory of 2228 2352 rundll32.exe 28 PID 2352 wrote to memory of 2228 2352 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec752261828b01df7b4c75d4068e3809_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ec752261828b01df7b4c75d4068e3809_JaffaCakes118.dll,#12⤵PID:2228
-