Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll
-
Size
1.0MB
-
MD5
47ea2fc0172f1561436681b5eb8e789c
-
SHA1
f58c510f0ecff8a4f62c4b5ee5260cfd2481707c
-
SHA256
100ad35bc41ad07baea43e66e8b69b57b765fffb103464f9ea6cc61eaeb8bebd
-
SHA512
fe601404091c72447397ac262403a17671619b25bb69087c11142fa17631c27a57929993c59aa87db034497f39ae428e1dd4cc73dea9db1d6c546a755b23f69b
-
SSDEEP
24576:2KeFRSUBZD0XpZQUYEu+pS0+M3tb0pvaep5ZUYuZ:IFjBh0jdDu/0J3tCieDIZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2472 1508 rundll32.exe 83 PID 1508 wrote to memory of 2472 1508 rundll32.exe 83 PID 1508 wrote to memory of 2472 1508 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47ea2fc0172f1561436681b5eb8e789c_JaffaCakes118.dll,#12⤵PID:2472
-