Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll
-
Size
16KB
-
MD5
2e247aa58036f60dea6391ef4a1444f6
-
SHA1
e41b42c973e8ff423981991a133876e949407965
-
SHA256
8c1c01f51cdf05ebf0d7a17748990cba28ffb2d506d06ab0b6aa56c2b3760eaf
-
SHA512
0f36db1a403aa4b3e4d255718c1b769f850ca36cee01a273a89588918b02a9c86dcac1b8435f2db85b64fa4f3ae63e9e09d0332547c84ebc5be315120afb6783
-
SSDEEP
384:skF53wvnjt5V38HzMxWfBgMdxHLkZl+eBv9B7ieE:s+53kjt5eAQfGMdxHwZl+S9B7LE
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1312 2240 rundll32.exe 28 PID 2240 wrote to memory of 1312 2240 rundll32.exe 28 PID 2240 wrote to memory of 1312 2240 rundll32.exe 28 PID 2240 wrote to memory of 1312 2240 rundll32.exe 28 PID 2240 wrote to memory of 1312 2240 rundll32.exe 28 PID 2240 wrote to memory of 1312 2240 rundll32.exe 28 PID 2240 wrote to memory of 1312 2240 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e247aa58036f60dea6391ef4a1444f6_JaffaCakes118.dll,#12⤵PID:1312
-