Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll
-
Size
92KB
-
MD5
16f08c5bfe69cd8e5de8162b94329c2c
-
SHA1
ee880cc1cda435715c5367059d4c6be90e3bebc7
-
SHA256
7a7fa682da92e136ee1306b1b76be1a96a349065a843f71ec9ecf5751555a04d
-
SHA512
4447827a50759eccb645955f6697d7a1a6b079537653132f94813d12f352dcdc2df743e5746936ee580e17609972237f7759c83e17eeb9fdfbbeb926cacec9bb
-
SSDEEP
1536:LfCnsEa9esstx4nUpBr6iqGmjbBKcSq+D+CWY8LyEu5DHW3Gm20JvpT:2sHoBx4niJ6ScSxD+CWYYu5jWW4RT
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Frocir = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1412 rundll32.exe 1412 rundll32.exe 1412 rundll32.exe 1412 rundll32.exe 1412 rundll32.exe 1412 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 2944 wrote to memory of 1412 2944 rundll32.exe 28 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29 PID 1412 wrote to memory of 2624 1412 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll",iep3⤵PID:2624
-
-