Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
61645330c61a316c542aad1ef828847a_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
61645330c61a316c542aad1ef828847a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
61645330c61a316c542aad1ef828847a_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
61645330c61a316c542aad1ef828847a
-
SHA1
1700ec5dc4f28e0bc6130130a12200bff68d2e32
-
SHA256
67c771d4d01def6147dd8571c079ea2ea6882ee833cbd5762204f4777dba10ce
-
SHA512
0c55e3df80c89d67ed6df9f6d5582b5a1fbd0f6d61fc2aae824d216209a45ae7af20dd2ca5b7daf2cf79feebe9da933225688b64674a6135935ec3776fa3e7d2
-
SSDEEP
24576:QlJLVH14k9zWnWM2SSEQWmQVyddaoHQEQOeS/riT52c:uJN1RFl0Qd9IfS/r052c
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2144 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SmileEDI\logs\20240521.log rundll32.exe File opened for modification C:\Windows\SysWOW64\SmileEDI\logs\20240521.log rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2144 1260 rundll32.exe 28 PID 1260 wrote to memory of 2144 1260 rundll32.exe 28 PID 1260 wrote to memory of 2144 1260 rundll32.exe 28 PID 1260 wrote to memory of 2144 1260 rundll32.exe 28 PID 1260 wrote to memory of 2144 1260 rundll32.exe 28 PID 1260 wrote to memory of 2144 1260 rundll32.exe 28 PID 1260 wrote to memory of 2144 1260 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61645330c61a316c542aad1ef828847a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61645330c61a316c542aad1ef828847a_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
- Drops file in System32 directory
PID:2144
-