Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 12:04
Behavioral task
behavioral1
Sample
3a0458663d70cbde0099df95da451529_JaffaCakes118.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a0458663d70cbde0099df95da451529_JaffaCakes118.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
3a0458663d70cbde0099df95da451529_JaffaCakes118.dll
-
Size
339KB
-
MD5
3a0458663d70cbde0099df95da451529
-
SHA1
cae4d2752133e9351d2ad63fba4699558c7c922a
-
SHA256
f1bc14943c240f59b8d3ad4d6e3ad5568f896f80e79697e690612c5602fa653d
-
SHA512
d7fa5a2f15e5820afa9bdeda0af65ee4327df4a36c9fd09f5539686a5a2557e7c6cda20ab4afabfa903733371390afe5ea3f3ea0aa1a332078131299aad9c51b
-
SSDEEP
6144:5JA6u6E8HuxRmThfQCwA+lfAeCuHm0Me8IUykbnWJZ3O8V+b:P06E8HuTC4CkFkBIUykkZ3O86
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4140 wrote to memory of 4656 4140 rundll32.exe 90 PID 4140 wrote to memory of 4656 4140 rundll32.exe 90 PID 4140 wrote to memory of 4656 4140 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a0458663d70cbde0099df95da451529_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a0458663d70cbde0099df95da451529_JaffaCakes118.dll,#12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3624 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:4056