Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
2527caf66b3daee3bc9b13fcb76a6fbd_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2527caf66b3daee3bc9b13fcb76a6fbd_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
2527caf66b3daee3bc9b13fcb76a6fbd_JaffaCakes118.dll
-
Size
26KB
-
MD5
2527caf66b3daee3bc9b13fcb76a6fbd
-
SHA1
640c291a6417fc998ffb16a3c7ba8d1169de042b
-
SHA256
18bf4a2805505e121d68d2a4572d72276075e512d573225e8d9f6f2ad7a88b0a
-
SHA512
584375d06d50cec1e8e26eb73599f2377093a14a64adeb3caa2eae9aa1578aa64e17e24fb5ed86923d4d3e002e9d8f571c89a67f896f1601f79b4ef791393d79
-
SSDEEP
384:kzVEdyPUojgtdn6DrTEn08XqJAqUXYxl4Sl+9q7mWbHJLc:Hy8ojgtIsn0QZlKld8iHJg
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2020 2776 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3996 wrote to memory of 2776 3996 rundll32.exe 81 PID 3996 wrote to memory of 2776 3996 rundll32.exe 81 PID 3996 wrote to memory of 2776 3996 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2527caf66b3daee3bc9b13fcb76a6fbd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2527caf66b3daee3bc9b13fcb76a6fbd_JaffaCakes118.dll,#12⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 6323⤵
- Program crash
PID:2020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2776 -ip 27761⤵PID:4468