Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
20d1c822c857d41ba522d2fd18cbaacb_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
20d1c822c857d41ba522d2fd18cbaacb_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
20d1c822c857d41ba522d2fd18cbaacb_JaffaCakes118.dll
-
Size
530KB
-
MD5
20d1c822c857d41ba522d2fd18cbaacb
-
SHA1
31f9014d3d5ad1c292ca53ea0d9cb4a666f0c413
-
SHA256
b00ea42d64c75033e36c62b3baff01079abf3e67646ceff1f0c9733cdd2f70a8
-
SHA512
b345f52161c86914aa4eefa214237c76da0b876b41f9c207fa200d8438434bb157b73d8e3de04fcd7132fd98e696a51db7cf342aae18c98f3d2a5d621e8e3adf
-
SSDEEP
12288:WyF3SrUVaX7zyCyHHjDLLhSuZhqVSNlw8XkMgrNGq:WyF3Sr0aiC4vhSOhGSvbxgrAq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1068 1980 regsvr32.exe 83 PID 1980 wrote to memory of 1068 1980 regsvr32.exe 83 PID 1980 wrote to memory of 1068 1980 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\20d1c822c857d41ba522d2fd18cbaacb_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\20d1c822c857d41ba522d2fd18cbaacb_JaffaCakes118.dll2⤵PID:1068
-