Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
025297aa6ef05ddf3cf340a6df613d46_JaffaCakes118.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
025297aa6ef05ddf3cf340a6df613d46_JaffaCakes118.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
025297aa6ef05ddf3cf340a6df613d46_JaffaCakes118.dll
-
Size
38KB
-
MD5
025297aa6ef05ddf3cf340a6df613d46
-
SHA1
80deeff5c4ff30ecd69306d957e501efc2ab3ef4
-
SHA256
c3a0764e31fb3f69e5ae9650f5145dafd5a3297949a51eca116fc790cf9c679d
-
SHA512
0b83d3648c069764c32d5ca5b3c6bc7dd1426bcf2539ba3a9cc80d0370a56da756bc9e8d27e2b0955d988ce9b5e5f2c07a80b4f7bdd58cb32ce832aeb7c4480f
-
SSDEEP
384:h8LESNvkoKG8Dsc4o+gT5TesZfCXwYURX+1rk0kMwbeB:h8Lh8tGysvoJlTpbPRX+1Q5liB
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 540 wrote to memory of 1124 540 rundll32.exe 82 PID 540 wrote to memory of 1124 540 rundll32.exe 82 PID 540 wrote to memory of 1124 540 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\025297aa6ef05ddf3cf340a6df613d46_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\025297aa6ef05ddf3cf340a6df613d46_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124
-