Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 02:32
Behavioral task
behavioral1
Sample
f94f2d0b11e314fcbf76cd7387762fca_JaffaCakes118.dll
Resource
win7-20240319-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f94f2d0b11e314fcbf76cd7387762fca_JaffaCakes118.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
f94f2d0b11e314fcbf76cd7387762fca_JaffaCakes118.dll
-
Size
67KB
-
MD5
f94f2d0b11e314fcbf76cd7387762fca
-
SHA1
4cd3950bd63320db4a3894c0a5229b46915d1660
-
SHA256
62ee96e2957915dcc95edbe3d2b1eda43299ed001926b51c88acc9168353cd4a
-
SHA512
c7446f6a1af0a6904455b0ecf86967f1621ebb54399aab339f54955b5ce580b536ffac7f03cf71f551ff3394132600674e5e139e71ee76e8d858d0e175db0b80
-
SSDEEP
1536:p+CZ8LwKKjTAG9oKsSTGEocJfPXnF2I2MPGOwcdHpXjOd2y8FNJ:gXEdoKs1cJXVWMPGOwWHVhZ
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1780-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1780 2184 rundll32.exe 82 PID 2184 wrote to memory of 1780 2184 rundll32.exe 82 PID 2184 wrote to memory of 1780 2184 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f94f2d0b11e314fcbf76cd7387762fca_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f94f2d0b11e314fcbf76cd7387762fca_JaffaCakes118.dll,#12⤵PID:1780
-