Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll
-
Size
650KB
-
MD5
fa9e845afd7952aba059e766b0c61bbd
-
SHA1
8b21b536f489134ada957809e09589741fde5f9d
-
SHA256
05e911dfc0f644b9bf90f0ca6686784fa4ed9d6f6db119129408f99761df246f
-
SHA512
d96adeb16cb709d50414a952ab78a098c2753dd45897cfee5d9c107a4cd66fe7bbc1f8095a7b6f832fe3bd177868f0ebffeaf88e5e55da17da38f2ea43c1efdd
-
SSDEEP
12288:bCo9lUzOvdYImmWE2h/eWtBvmfDRUvqWECYQMFNun8l3VcQSc:h9l5mmWEG/eWPvmfDRUvwNQMFNu8l3Vx
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa9e845afd7952aba059e766b0c61bbd_JaffaCakes118.dll,#12⤵PID:2992
-