Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll
-
Size
120KB
-
MD5
f3eb90431aa8a109d0219d8072d7c23b
-
SHA1
fb97477f9c989ff3ce7033e2b6e8bd6f81f8f00d
-
SHA256
ca86450ec13f1d39942db4f5a01ee9cd225aabc2a666e479b5a8628074d4af4f
-
SHA512
a188705ce622e0fb4b984cb2e499c617832e2167072a862de738fb3a59cc5bc388502984a97dd5e35228a115f6582e08d9e8dbbf510600eccc44b70c2277c1e4
-
SSDEEP
1536:trVq1QLko9egQKFesV4uHIVENTAs3Qcn/VPJgoJn8:2YkolQKFalENTXAcn/VPJgL
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2028 1968 regsvr32.exe 82 PID 1968 wrote to memory of 2028 1968 regsvr32.exe 82 PID 1968 wrote to memory of 2028 1968 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f3eb90431aa8a109d0219d8072d7c23b_JaffaCakes118.dll2⤵PID:2028
-