Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
ffa638e41d88ce1e1c9c8260e068c60e_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ffa638e41d88ce1e1c9c8260e068c60e_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
ffa638e41d88ce1e1c9c8260e068c60e_JaffaCakes118.dll
-
Size
946KB
-
MD5
ffa638e41d88ce1e1c9c8260e068c60e
-
SHA1
daa62386c6f8f0a47be95ce6a93c6b7f5331a8fa
-
SHA256
bc402f6c18661ed2afc2c5d2ebca315d1ad533c7f76f44160ce698239da75425
-
SHA512
6c1e5860a66f2c2ea3f9657da01e4833ac5cca3f01187eb071e368162a7b704cfe0ed263f45d6d3188eefce3f5c0f8c1f02d9dd982ff7bbc83f95e2548aa94e1
-
SSDEEP
24576:QEjHVLgUwnW5AwGLTUT/5tbWUUR5n+YMrwTU+4L:QA1LbmwVtbWUU7oUTPo
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 716 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2488 wrote to memory of 716 2488 rundll32.exe 85 PID 2488 wrote to memory of 716 2488 rundll32.exe 85 PID 2488 wrote to memory of 716 2488 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ffa638e41d88ce1e1c9c8260e068c60e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ffa638e41d88ce1e1c9c8260e068c60e_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:716
-