Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll
-
Size
190KB
-
MD5
f2c117501fddbe4b43835681c8fb7dd2
-
SHA1
efb389307c5bc954a2b1c33372a8b7580fefbceb
-
SHA256
8e1235c9d89b045e71bc748e2a3640baa006579e1f9f02bfc1d269c291889cba
-
SHA512
009aa5424a2985dd73a06fff0fbb4c39ff924a738bb4e9ba0e14b4f47c1c079ec5ed313c86038a675f2705a8409d755392555acc8164975b674311fc6b30f76c
-
SSDEEP
3072:V8+ZH3QKakSgZfPiavu7nh4WKwE4trX1LKiM69lgdHXct+Z3lu/s4OnUr:VJgr3AiavcfKf43LBQBXc8k/ROn
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2368 wrote to memory of 3208 2368 rundll32.exe 81 PID 2368 wrote to memory of 3208 2368 rundll32.exe 81 PID 2368 wrote to memory of 3208 2368 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f2c117501fddbe4b43835681c8fb7dd2_JaffaCakes118.dll,#12⤵PID:3208
-