Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
266ae4c931b94961aa496438010d5944_JaffaCakes118.dll
Resource
win7-20240419-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
266ae4c931b94961aa496438010d5944_JaffaCakes118.dll
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
266ae4c931b94961aa496438010d5944_JaffaCakes118.dll
-
Size
30KB
-
MD5
266ae4c931b94961aa496438010d5944
-
SHA1
e3c90f8e737fa6b6af180a4eb8781d9953ec82cf
-
SHA256
e54b2b88b75a6d1e11e73efb83ec381a39509a41b2fb8b4875b35557382c70df
-
SHA512
8ff2513083bf28dd5d7d60bc134251d65cb3e65be344f11f71424cca46d42b6f0f470de516eef7e5921d2f956ca6d79082e9c4d4b8e93bc9f25d32a7935f8213
-
SSDEEP
768:bjGMWflD3dH8nrlA8Xdg0YBd00dpqlzTSk9:bjGhNDNH6hj2Rd0GpqxSk
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1808 2780 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2780 2472 rundll32.exe 87 PID 2472 wrote to memory of 2780 2472 rundll32.exe 87 PID 2472 wrote to memory of 2780 2472 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\266ae4c931b94961aa496438010d5944_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\266ae4c931b94961aa496438010d5944_JaffaCakes118.dll,#12⤵PID:2780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 5483⤵
- Program crash
PID:1808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2780 -ip 27801⤵PID:3796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4432,i,18341222626402534844,12352985901844242237,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵PID:1944