Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
0c0eacf351db0400fb918e18643d4da2_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c0eacf351db0400fb918e18643d4da2_JaffaCakes118.dll
Resource
win10v2004-20240419-en
General
-
Target
0c0eacf351db0400fb918e18643d4da2_JaffaCakes118.dll
-
Size
6KB
-
MD5
0c0eacf351db0400fb918e18643d4da2
-
SHA1
6c5060e5c083b4fbf94bba13fb6ec80aeee3a9f2
-
SHA256
5a585d425ab5384ab0ea1a5e24586ed51ac168a440c5cf5bea08f9e7e0f65f79
-
SHA512
29505f0ea06fbbe07b5ea2c9751ffd5bfdec501d8fdb397b7e5b3e278d038ac2dc640491cee209b4b5927ea74f7f730b82318c1e2f2d6cb710e702b66d6b7b50
-
SSDEEP
96:L1v6SKAS51HSkxiiMFFatck75XahJbJMvEYEm3qanntcfnp3f:LZWRxi/Mtc8ahJWVRtYpP
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2556 4640 WerFault.exe 85 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2008 wrote to memory of 4640 2008 rundll32.exe 85 PID 2008 wrote to memory of 4640 2008 rundll32.exe 85 PID 2008 wrote to memory of 4640 2008 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0eacf351db0400fb918e18643d4da2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0eacf351db0400fb918e18643d4da2_JaffaCakes118.dll,#12⤵PID:4640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 6283⤵
- Program crash
PID:2556
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4640 -ip 46401⤵PID:4520