Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll
-
Size
168KB
-
MD5
42b6da54d81a2e4ba7dfa99daa8195e7
-
SHA1
805f134c4df71ff1fa14d04edc4f623e2f01dd8f
-
SHA256
3a43a5f72c3a858ccfdf8d0f6f43e3ee74bc35cacf9bcc0b0304d3b3f2cc0ffc
-
SHA512
36884a0cb5f5b1f340e087302e7428874d87681583fc16ed15be50587677eb54a83e9ba96809ee2f5dfd8311d47c186479b1296b10a80cafb7af1632ab72cd2e
-
SSDEEP
3072:zvj3ceH/rvjpDkQs+12nBkuJIOtAekYYYYYYYYYYYYYYYYYYYYYYYYYYYFYYYYYn:zvjF/T9D8nZIOtXkYYYYYYYYYYYYYYYu
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2200 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\42b6da54d81a2e4ba7dfa99daa8195e7_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:2200
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a