Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
27cbf3b0244a31aad25df685859f8023
-
SHA1
2b812b2d68f612de69c135aa940ccdafaad32115
-
SHA256
04a75b67321c6dbfe75ce1ff08220446ae4c3ff06adb65f2f5cf5d3124403ae1
-
SHA512
b1f6fcf8f9979eed0cccd09b59a3cb70aeb3f147ea8aabe38a57c97cd447eeb100598b9d8d5f301e29f0216244880bb454a655202196c3197e26947a77504df3
-
SSDEEP
24576:alsTXlc5VKbeu+pS0+M3tb0pvaep5ZV1yji:ZT2u/0J3tCieDki
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1392 wrote to memory of 2032 1392 rundll32.exe 28 PID 1392 wrote to memory of 2032 1392 rundll32.exe 28 PID 1392 wrote to memory of 2032 1392 rundll32.exe 28 PID 1392 wrote to memory of 2032 1392 rundll32.exe 28 PID 1392 wrote to memory of 2032 1392 rundll32.exe 28 PID 1392 wrote to memory of 2032 1392 rundll32.exe 28 PID 1392 wrote to memory of 2032 1392 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27cbf3b0244a31aad25df685859f8023_JaffaCakes118.dll,#12⤵PID:2032
-