Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll
-
Size
247KB
-
MD5
27f94077de7b68f59d994d353fc4b1fd
-
SHA1
dadb9fd1cf123388c94cf4636d6ed5e756a7e348
-
SHA256
9775baccfa4ebd99dc2681e77438bfd9eb1542b65b741603ff84da4af54eae7b
-
SHA512
dc4028461195731bc6afc60c15a8ae54683ed7d0f1c60734f3a888e369117fbb24a21674ecef226252dc14de14065eb192a6534b41a2093fd79372df423753e5
-
SSDEEP
6144:BkNG+NdkuFGXBYV3APFkvCN6J+zUwvWgxUH:BkDNd3GXBi3UFkvfJ+4+TE
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2260 2240 rundll32.exe 28 PID 2240 wrote to memory of 2260 2240 rundll32.exe 28 PID 2240 wrote to memory of 2260 2240 rundll32.exe 28 PID 2240 wrote to memory of 2260 2240 rundll32.exe 28 PID 2240 wrote to memory of 2260 2240 rundll32.exe 28 PID 2240 wrote to memory of 2260 2240 rundll32.exe 28 PID 2240 wrote to memory of 2260 2240 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\27f94077de7b68f59d994d353fc4b1fd_JaffaCakes118.dll,#12⤵PID:2260
-