Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118.dll
-
Size
24KB
-
MD5
1b7a07c6021ad38c0c466ec3d6cb4f14
-
SHA1
a89833db78089a8a0cb02e59459bcadf823a66b1
-
SHA256
dc4910461ec12deae1ff956d70258d015c069ae7f969c33e14d9fa39e3fb198d
-
SHA512
8eebc7703be7db3a62dc9c7bae0206e828bc49914ad28b922af520fd8bcd0f56ec1d8d107c0adf269911ee0d5aef898002cc4584e79e4717ab7088cfbbe9459e
-
SSDEEP
192:UxXwTiyREK37hQKfabE2v5GgLLmeYl9KensG6qpFDH0jzDILjq:EyRE8+K+EqlLg/sN0jAzkvq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3332 2720 rundll32.exe 90 PID 2720 wrote to memory of 3332 2720 rundll32.exe 90 PID 2720 wrote to memory of 3332 2720 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b7a07c6021ad38c0c466ec3d6cb4f14_JaffaCakes118.dll,#12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1276,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:81⤵PID:3588