Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 23:26
Behavioral task
behavioral1
Sample
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll
Resource
win7-20240220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll
-
Size
12KB
-
MD5
26a0054b2a1ddc9b6ab3a787becc144e
-
SHA1
b0c4e934f22b4816303bf874de7911b4958259ba
-
SHA256
9698bbc14768a2a212a4e1353e24d4b3ab027d3e32c95ffc7135d8469724c7f9
-
SHA512
98724618bd2e83094e1aa08d71dd3cfe010927450682eb7296d61ac7b3be174dad7f1ad9c69d25ffbac7b21bb2ef60ced59818664b9f07483b7dc149e4ef7b34
-
SSDEEP
192:eR7BSMx15w3q58YYw73dIAVnmZl4pGNzkhYcrUHsUR+oIfKnd9+AwlXaeJI8o:eJn8YJv9zzIHJR+NfCd9+Aw93
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4228-0-0x0000000010000000-0x000000001000D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3596 wrote to memory of 4228 3596 rundll32.exe 81 PID 3596 wrote to memory of 4228 3596 rundll32.exe 81 PID 3596 wrote to memory of 4228 3596 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118.dll,#12⤵PID:4228
-