Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 08:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d6b03dee888a1b7d781715ccf31828d_JaffaCakes118.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d6b03dee888a1b7d781715ccf31828d_JaffaCakes118.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
0d6b03dee888a1b7d781715ccf31828d_JaffaCakes118.dll
-
Size
70KB
-
MD5
0d6b03dee888a1b7d781715ccf31828d
-
SHA1
3e70849096d6110af4f5cbfe71c0a5c4f19b7486
-
SHA256
861dfcd736fba66d550e1c72db1906c8e6d9e1e4d9326badcf315370964d76d5
-
SHA512
5fae2f9a9968adb398a3b8765b12abe65866177bbd80dbb2649f01666ba198b9ef7daea2953ebc621d0da299c8e407c84afac2ab05ee9119d12c93261014a1c2
-
SSDEEP
1536:meGhUZSZFbr124i/0Btr5QZLO+jJvgD4zJ/5:/YUWbw4Iutr1+jJvgD4VR
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4320 4884 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4884 4764 rundll32.exe 91 PID 4764 wrote to memory of 4884 4764 rundll32.exe 91 PID 4764 wrote to memory of 4884 4764 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6b03dee888a1b7d781715ccf31828d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6b03dee888a1b7d781715ccf31828d_JaffaCakes118.dll,#12⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 5443⤵
- Program crash
PID:4320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4884 -ip 48841⤵PID:1256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:2184