Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll
-
Size
80KB
-
MD5
228cde4a17d10c7efd416c2842bdfe6e
-
SHA1
fff40eaf6441a45d152013407cf728c3516de570
-
SHA256
1aba3c877a8bdae0b089fd71b252953866bc127f8da12b8ba49d5ad68241985b
-
SHA512
ee42aac1ece9ab95216cd9e15c7ef9a878a2ae060f8ee021561415b3402ca17ef74955c5c72b021d5b7ba9086ab37b7c9ca9e651c188e9d3a750fdf75c776aa9
-
SSDEEP
1536:prCPwhzE3HsjfmOI6v3PA6cUCRI8PKauv0APCl+RvODAdEjNHwl5UBOv:FrhsHsLTvfaUCG1xvTvRuAejNHGUB2
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4368 3048 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4408 wrote to memory of 3048 4408 regsvr32.exe 83 PID 4408 wrote to memory of 3048 4408 regsvr32.exe 83 PID 4408 wrote to memory of 3048 4408 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\228cde4a17d10c7efd416c2842bdfe6e_JaffaCakes118.dll2⤵PID:3048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 5963⤵
- Program crash
PID:4368
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 30481⤵PID:1856