Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
f28f4a9d80891c215149328ac5d2839a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f28f4a9d80891c215149328ac5d2839a_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f28f4a9d80891c215149328ac5d2839a_JaffaCakes118.dll
-
Size
16KB
-
MD5
f28f4a9d80891c215149328ac5d2839a
-
SHA1
95f787c8e923ac73d4fc999dda8add5f86d105e5
-
SHA256
1f8fdcf42444937f065fb09c1d87defc4ba99067baf921d0e746ce526a187893
-
SHA512
7ab9410aad9108dd1c0d2eba0670e5a59fb6d5a7b919af54f8eab1e460f6d5533abff5d771a09c8892ff6542c248e1eac72061f0b14c9b1fcf5c2059eda44540
-
SSDEEP
384:s+6X9gqNBaUOmZsX1DJzHODvSmfJhKJHDVbKyVjb5ht5ncJQPDIc:qgq/zZsX1DtHCK4KJjbVbXt5ncJ+D
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2800 2388 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2280 wrote to memory of 2388 2280 rundll32.exe 28 PID 2388 wrote to memory of 2800 2388 rundll32.exe 29 PID 2388 wrote to memory of 2800 2388 rundll32.exe 29 PID 2388 wrote to memory of 2800 2388 rundll32.exe 29 PID 2388 wrote to memory of 2800 2388 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f28f4a9d80891c215149328ac5d2839a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f28f4a9d80891c215149328ac5d2839a_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 2483⤵
- Program crash
PID:2800
-
-