Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll
-
Size
30KB
-
MD5
f94c2fd16ba335b79576dbed77fd1a8e
-
SHA1
482d99420581eee34c943c3be1ba734f5465c0b5
-
SHA256
d99cf11dec8c0e8204775ccc9090408ae10eacfd4ddbcbd32605b5580cf4f5a6
-
SHA512
be9c0ad64a5dfd3a3c6d7b833720a50968bc74af2db85cd2d17ebfaac8e54cdb6e1f47daaaa2b3b1cc908ed65dcf0bc1acd4ff07530f935935a9c32115ec914b
-
SSDEEP
384:DhiMKS5sT1Wzjm2ivSyaZYI1bI6fDpBsp1MVP7BoMiDpR2KA89nLdnXfUp0NaYM2:DuS5sBKy2ArARJJ7l2MibHvdvULYMfe
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 828 1928 WerFault.exe 88 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1928 5028 rundll32.exe 88 PID 5028 wrote to memory of 1928 5028 rundll32.exe 88 PID 5028 wrote to memory of 1928 5028 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f94c2fd16ba335b79576dbed77fd1a8e_JaffaCakes118.dll,#12⤵PID:1928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 5443⤵
- Program crash
PID:828
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1928 -ip 19281⤵PID:2396