Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll
-
Size
48KB
-
MD5
0888944d096001de1824aab9f2f04fec
-
SHA1
487428cd5233bd11897c96e947e9abd8eccc6193
-
SHA256
fb2e9ae636318af9223bed23400d7531e2ab2d23f91f448669c2d7ec5a4170ce
-
SHA512
80c7ad2b6eae7f1cde82be7f25e29099e50ad56391b84e4e2ea5b7dd3c0c5f1c6485b8e9723008c120a4de6ffe32e071879d96d8dab5aed99930fa202f8df8b6
-
SSDEEP
768:OmpM8V/5Q1GuorDx8UBuwiHCjMATj/78rIhYZJWM4R12gxvcDxOHONR+:OajG6V8aiHCj/TjGWM4R12g+fNR+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 428 wrote to memory of 4404 428 regsvr32.exe 82 PID 428 wrote to memory of 4404 428 regsvr32.exe 82 PID 428 wrote to memory of 4404 428 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0888944d096001de1824aab9f2f04fec_JaffaCakes118.dll2⤵PID:4404
-