Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll
-
Size
328KB
-
MD5
f20f07e8bd65d321845a9df4b34e12e8
-
SHA1
319778ac4706533cbfedbc43a40a6ca11e581f32
-
SHA256
393c0246c461558bc8b4e30fdaf018f0ddc3d8c4424238c05948a6273b23eaa3
-
SHA512
b03f3cb4f11aa6c4b60e628417b36920c9731d77c4e8b6d24983542d6f28ed0e677c50d7654d4d0da5931099944e01f8a989c719d621388b92e1c7b97a5e6a12
-
SSDEEP
6144:QZXISo9g9OTuD2pQFWTq+mUHtQ2mUfzdvbwN/Bvuzi:QJItu9Eu1WTq+urEzdjwN1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28 PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28 PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28 PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28 PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28 PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28 PID 2352 wrote to memory of 2196 2352 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f20f07e8bd65d321845a9df4b34e12e8_JaffaCakes118.dll2⤵PID:2196
-