Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19/06/2024, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll
-
Size
19KB
-
MD5
0015068d9af7ef9da00d38f908362533
-
SHA1
3f444824870ed61a3c3f707d22fd7521f9eceb92
-
SHA256
cb417f25006c0c05a8d272d6a3f358a853459b4c00cdd346bcc749c9a7126e9a
-
SHA512
568551ed16daa975e29702fe8e1884f7741645abefeb360631af7fed53ce081843c0258ba51c4a214b79d8cbdd306a68e98420b0440cfe0c90f73f4fccebf2ae
-
SSDEEP
384:eWWTEcWePKORLzOIB5X5mFh0V4wKOZk+SaJgD/JSu116:VaKORLzOIBF5yCq8ZkTaqDS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2440 wrote to memory of 3248 2440 regsvr32.exe 81 PID 2440 wrote to memory of 3248 2440 regsvr32.exe 81 PID 2440 wrote to memory of 3248 2440 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0015068d9af7ef9da00d38f908362533_JaffaCakes118.dll2⤵PID:3248
-