Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05171aa923130eafd8b2d1949e006f8f_JaffaCakes118.dll
Resource
win7-20240611-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
05171aa923130eafd8b2d1949e006f8f_JaffaCakes118.dll
Resource
win10v2004-20240611-en
1 signatures
150 seconds
General
-
Target
05171aa923130eafd8b2d1949e006f8f_JaffaCakes118.dll
-
Size
30KB
-
MD5
05171aa923130eafd8b2d1949e006f8f
-
SHA1
d4580f00d8130bc73046f8a7858c18a450bb512f
-
SHA256
0b8ed4f25df8a52aea46d666343a88ce52076b6d89ff312a8bbb52f3ec3905eb
-
SHA512
95ff56f0a46b8867452c8eebc7d3b71394560f9c601292aa4c0aa56da4964e4ddba9dfa28056b6367cb0a3a371279147a3c6f222df5c51cf33754a93053218a0
-
SSDEEP
768:fnADLGtNDJL6j6DjtesDNVB6CQDC5wRk4iDTJ:fnAD+NKuBNVBzgC2ifJ
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2908 2300 rundll32.exe 28 PID 2300 wrote to memory of 2908 2300 rundll32.exe 28 PID 2300 wrote to memory of 2908 2300 rundll32.exe 28 PID 2300 wrote to memory of 2908 2300 rundll32.exe 28 PID 2300 wrote to memory of 2908 2300 rundll32.exe 28 PID 2300 wrote to memory of 2908 2300 rundll32.exe 28 PID 2300 wrote to memory of 2908 2300 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05171aa923130eafd8b2d1949e006f8f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05171aa923130eafd8b2d1949e006f8f_JaffaCakes118.dll,#12⤵PID:2908
-