Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
97327266b0a3c683f65c2fe0964cc7ce_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
97327266b0a3c683f65c2fe0964cc7ce_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
97327266b0a3c683f65c2fe0964cc7ce_JaffaCakes118.dll
-
Size
111KB
-
MD5
97327266b0a3c683f65c2fe0964cc7ce
-
SHA1
2288d1306edb7ec2cdf604e01147d8ddaa8433c5
-
SHA256
26c7f686a0380f0c3b7d7b590b649a2518fa1d8787e23d4acb5e43b7211d902f
-
SHA512
76c4a3adddf670400adab27dd6a795d81df1f33ba1a9d1bc470f1496dc751f528dae93d89640ff875cad7e729833744b0b8cb6b7a74d2b34e3732f08bf777ce7
-
SSDEEP
1536:AiCBOn7u8hp91L1bo9IRWZ2DZkJA7BXcgK9ocNnC756b5jUpghY:AA7uap91RV0eQA7Zc1ocNnC75fX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1500 4608 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1004 wrote to memory of 4608 1004 rundll32.exe 84 PID 1004 wrote to memory of 4608 1004 rundll32.exe 84 PID 1004 wrote to memory of 4608 1004 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97327266b0a3c683f65c2fe0964cc7ce_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97327266b0a3c683f65c2fe0964cc7ce_JaffaCakes118.dll,#12⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 6203⤵
- Program crash
PID:1500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 46081⤵PID:3868