Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 01:24
Static task
static1
Behavioral task
behavioral1
Sample
01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll
-
Size
40KB
-
MD5
01b07cb4295ee41ebdca46789e762e35
-
SHA1
70f71cc3f1d2a030adbf316cb1e6c568ae1956cd
-
SHA256
f12189029882e631f3cd1e55b1492aea636d610cb82d2b83bac8852df828bd7d
-
SHA512
b720a3614d1006b3cd3d3a3708884dc9dd4436592d2043a8e47448d0de03af374c1a78872d503f5ca1d48c87d3f7b1b2b04474edfa8ccdbcdaf3e54b9da40a74
-
SSDEEP
384:rcPTLFwVtTr45Raf3/iDYABg3/cte5i5RBR0769m5hxGXI3h+dvGIuIINQuac0M+:sypoi3KDo3/Iec79exGKA4ImNQuF9i
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1372 3252 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 640 wrote to memory of 3252 640 rundll32.exe 83 PID 640 wrote to memory of 3252 640 rundll32.exe 83 PID 640 wrote to memory of 3252 640 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\01b07cb4295ee41ebdca46789e762e35_JaffaCakes118.dll,#12⤵PID:3252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 6283⤵
- Program crash
PID:1372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3252 -ip 32521⤵PID:1324