Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 23:51
Behavioral task
behavioral1
Sample
31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
-
Target
31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll
-
Size
4.3MB
-
MD5
31acaab0dc1ff13752b6692e006a0849
-
SHA1
ae2675af4abf0138f8ed8cdcea81762d9e4704bb
-
SHA256
7b9234facc1db74bf568ff74e86c888c0dd10915d99b621e6a902b5bbaa5d1c2
-
SHA512
4014813ab88f0b36794aa903ad67416e5acd27510928768920b7a1089cd6964a2c1b4e1dab42e4c30184fd93bd1c8282e0cfb40976fc32b644032ad168e606d6
-
SSDEEP
98304:71x/5hJzli4E6a4TFE2kr/tRZl8Nu8D0nup:/1I4E6bTufZld8DCu
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3088-1-0x0000000074A40000-0x0000000074EAA000-memory.dmp vmprotect behavioral2/memory/3088-3-0x0000000074A40000-0x0000000074EAA000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3088 rundll32.exe 3088 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3008 wrote to memory of 3088 3008 rundll32.exe 90 PID 3008 wrote to memory of 3088 3008 rundll32.exe 90 PID 3008 wrote to memory of 3088 3008 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31acaab0dc1ff13752b6692e006a0849_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3244,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:81⤵PID:4140