Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
1770291608779ead6fead9a5e8b12bd7_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1770291608779ead6fead9a5e8b12bd7_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
1770291608779ead6fead9a5e8b12bd7_JaffaCakes118.dll
-
Size
346KB
-
MD5
1770291608779ead6fead9a5e8b12bd7
-
SHA1
300920c7fc1c1e3be7cb7e35240530c5ef6f5caa
-
SHA256
4da435913b12b5651da6765ec27bf6bb0cc4485b7d2c653c5afcfec2a9408466
-
SHA512
82d802cf2446477f167063eec66f79ada6be2e5ec06ff0669915e25a1ed42706bdad4fcc38844194d9cbd88d1e3543187fca848cf2e516700251c419218005e9
-
SSDEEP
6144:qAstpSrrh0O0E9Zd8J0ypXIKf8q3wZVf9L7AYDfUrHFz61TBrX4QYulwUq:lstpSrrhf0E9Zd8J/px8q3wZVf9LRDfG
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1828 1976 rundll32.exe 28 PID 1976 wrote to memory of 1828 1976 rundll32.exe 28 PID 1976 wrote to memory of 1828 1976 rundll32.exe 28 PID 1976 wrote to memory of 1828 1976 rundll32.exe 28 PID 1976 wrote to memory of 1828 1976 rundll32.exe 28 PID 1976 wrote to memory of 1828 1976 rundll32.exe 28 PID 1976 wrote to memory of 1828 1976 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1770291608779ead6fead9a5e8b12bd7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1770291608779ead6fead9a5e8b12bd7_JaffaCakes118.dll,#12⤵PID:1828
-