Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll
-
Size
307KB
-
MD5
239bfbb6dea7eb37e208333548fe028b
-
SHA1
a4dace9c0e92f4d93330f3b73fb00f750138325a
-
SHA256
5fc7b0312023cd2c1c8b119e902640b93c385ebf46b5bb36d85a57a262f15be6
-
SHA512
9509f42b34e86cdf140e0e2b181050c23ab455a46802ca9341a729dcd443962d46cccb8587398a248bbbdabca9534dd961344d12fb2992d9c4a8e431281e7d20
-
SSDEEP
6144:c88Duu0EIX4n+QR57+CJ9sUnSDxMCW+jQoC2m4JQREa+HD42RASo5D:38RrGkC6CmRPH2Qcc2R+D
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1704 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1704 1680 rundll32.exe 28 PID 1680 wrote to memory of 1704 1680 rundll32.exe 28 PID 1680 wrote to memory of 1704 1680 rundll32.exe 28 PID 1680 wrote to memory of 1704 1680 rundll32.exe 28 PID 1680 wrote to memory of 1704 1680 rundll32.exe 28 PID 1680 wrote to memory of 1704 1680 rundll32.exe 28 PID 1680 wrote to memory of 1704 1680 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\239bfbb6dea7eb37e208333548fe028b_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:1704
-