Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 23:26
Behavioral task
behavioral1
Sample
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll
Resource
win7-20240220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll
-
Size
12KB
-
MD5
26a0054b2a1ddc9b6ab3a787becc144e
-
SHA1
b0c4e934f22b4816303bf874de7911b4958259ba
-
SHA256
9698bbc14768a2a212a4e1353e24d4b3ab027d3e32c95ffc7135d8469724c7f9
-
SHA512
98724618bd2e83094e1aa08d71dd3cfe010927450682eb7296d61ac7b3be174dad7f1ad9c69d25ffbac7b21bb2ef60ced59818664b9f07483b7dc149e4ef7b34
-
SSDEEP
192:eR7BSMx15w3q58YYw73dIAVnmZl4pGNzkhYcrUHsUR+oIfKnd9+AwlXaeJI8o:eJn8YJv9zzIHJR+NfCd9+Aw93
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2200-1-0x0000000010000000-0x000000001000D000-memory.dmp upx behavioral1/memory/2200-0-0x0000000010000000-0x000000001000D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28 PID 2184 wrote to memory of 2200 2184 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll,#12⤵PID:2200
-