Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll
-
Size
117KB
-
MD5
f906bd017ea576cc3de969acc5ab5212
-
SHA1
f2d515ef8f8109f3fafcab6892e67e872eb1cc67
-
SHA256
d275576cfe12405a9ac53e9c02d223e1b2be7f6c3245e25749f13ecf19415bcf
-
SHA512
7848ae2ba820c52938a2f010ddd55c8bef8efd38f1c9996ad6e67f5226f7cb30199c8b8f6549438207b603cc56396c2a3e05e8ba0302326975afeff45e650923
-
SSDEEP
3072:xJYfCasEo39ENlCo5Vzv+ykAxisbiKhcIp5hD5wjVZb:xy6yeENJRN5xXVrpOBZb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 736 wrote to memory of 2692 736 regsvr32.exe 85 PID 736 wrote to memory of 2692 736 regsvr32.exe 85 PID 736 wrote to memory of 2692 736 regsvr32.exe 85
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\f906bd017ea576cc3de969acc5ab5212_JaffaCakes118.dll2⤵PID:2692
-