Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
-
Size
758KB
-
MD5
f95c12ffe59d184431daec724be28894
-
SHA1
bb526bb357e1b5b8489583a074360548d4261fff
-
SHA256
d66141bdfe66974c3f46f043af8003958a4b075c0d1058072826bf71ed6a9772
-
SHA512
2bec0159b7535ab12fdd2324c5f5cb134938dc4ad32772b22855a9a9dacb1bd355ce673a87969ddbde0fd318e6b504f40060ffc5361c9ef43f8f693f088ed4f4
-
SSDEEP
192:QPMT/KSXU430GRbjcdHEZNltr9ieoPQiu6rU5fz5deF04VCbcTAjttYAyF8pMy6B:n/KSXS+w6Lok64TAu/vKfy6K0o4d
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1440 wrote to memory of 2368 1440 rundll32.exe 28 PID 1440 wrote to memory of 2368 1440 rundll32.exe 28 PID 1440 wrote to memory of 2368 1440 rundll32.exe 28 PID 1440 wrote to memory of 2368 1440 rundll32.exe 28 PID 1440 wrote to memory of 2368 1440 rundll32.exe 28 PID 1440 wrote to memory of 2368 1440 rundll32.exe 28 PID 1440 wrote to memory of 2368 1440 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#12⤵PID:2368
-