Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll
-
Size
64KB
-
MD5
0819680f9633ccc846b3776cbc382bad
-
SHA1
93480c5c4d6c78b40df8b02aedf1fea4537a4b0d
-
SHA256
29769d04d492b5e7022afc2ba7af9f487d3ce2f9b164b1a189c389a42b77995f
-
SHA512
1abd9a4b75ee808b40a523bafd27b1c8134c68d59d1c66d251ccd7ad667a3b861100352b9c49f3f91fc01fce2aeffa9ba355b776351f31b350bfb28f6b270c03
-
SSDEEP
768:GTQ4Ghajq27LWlRJl/ny+0083sOWXezr5PqZwkk/aPi0C7FupuuBmIu:W0gZfwRPyhsMPqZFVCIFBmIu
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4196 1892 regsvr32.exe 83 PID 1892 wrote to memory of 4196 1892 regsvr32.exe 83 PID 1892 wrote to memory of 4196 1892 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0819680f9633ccc846b3776cbc382bad_JaffaCakes118.dll2⤵PID:4196
-