Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll
-
Size
92KB
-
MD5
16f08c5bfe69cd8e5de8162b94329c2c
-
SHA1
ee880cc1cda435715c5367059d4c6be90e3bebc7
-
SHA256
7a7fa682da92e136ee1306b1b76be1a96a349065a843f71ec9ecf5751555a04d
-
SHA512
4447827a50759eccb645955f6697d7a1a6b079537653132f94813d12f352dcdc2df743e5746936ee580e17609972237f7759c83e17eeb9fdfbbeb926cacec9bb
-
SSDEEP
1536:LfCnsEa9esstx4nUpBr6iqGmjbBKcSq+D+CWY8LyEu5DHW3Gm20JvpT:2sHoBx4niJ6ScSxD+CWYYu5jWW4RT
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eyuqavurogehud = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll\",Startup" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe 2080 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1556 wrote to memory of 2080 1556 rundll32.exe 90 PID 1556 wrote to memory of 2080 1556 rundll32.exe 90 PID 1556 wrote to memory of 2080 1556 rundll32.exe 90 PID 2080 wrote to memory of 2404 2080 rundll32.exe 104 PID 2080 wrote to memory of 2404 2080 rundll32.exe 104 PID 2080 wrote to memory of 2404 2080 rundll32.exe 104
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll,#12⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\16f08c5bfe69cd8e5de8162b94329c2c_JaffaCakes118.dll",iep3⤵PID:2404
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1296,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:81⤵PID:476