Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
f95c12ffe59d184431daec724be28894_JaffaCakes118.dll
-
Size
758KB
-
MD5
f95c12ffe59d184431daec724be28894
-
SHA1
bb526bb357e1b5b8489583a074360548d4261fff
-
SHA256
d66141bdfe66974c3f46f043af8003958a4b075c0d1058072826bf71ed6a9772
-
SHA512
2bec0159b7535ab12fdd2324c5f5cb134938dc4ad32772b22855a9a9dacb1bd355ce673a87969ddbde0fd318e6b504f40060ffc5361c9ef43f8f693f088ed4f4
-
SSDEEP
192:QPMT/KSXU430GRbjcdHEZNltr9ieoPQiu6rU5fz5deF04VCbcTAjttYAyF8pMy6B:n/KSXS+w6Lok64TAu/vKfy6K0o4d
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3252 wrote to memory of 3488 3252 rundll32.exe 91 PID 3252 wrote to memory of 3488 3252 rundll32.exe 91 PID 3252 wrote to memory of 3488 3252 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f95c12ffe59d184431daec724be28894_JaffaCakes118.dll,#12⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:2976