Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
280d33d030ac53f76624019b2a3f2f63_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
280d33d030ac53f76624019b2a3f2f63_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
280d33d030ac53f76624019b2a3f2f63_JaffaCakes118.dll
-
Size
247KB
-
MD5
280d33d030ac53f76624019b2a3f2f63
-
SHA1
b1e2f8f1bfb9eed34f692a0c5fab30660975bacd
-
SHA256
bdc3921e5f6a1331a97f4c7f452e01cfb9f94374c7a1b898cc38d80743b22c38
-
SHA512
3d11e12d6e5dd54ba2d3134cae8c2006806a3d40efe8e397d4e15116cc5d7c2dfe8364e5e7fa6fbe09bb3219dc843de6d3484274fc78ce66ee6000dc8296025a
-
SSDEEP
6144:lpTdemdyDRUz+WBRRpEu4AdjyB8rx4MqbmKTdiTd:DdeOyD2dzELaxx4M6bdYd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30 PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30 PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30 PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30 PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30 PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30 PID 2156 wrote to memory of 2704 2156 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\280d33d030ac53f76624019b2a3f2f63_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\280d33d030ac53f76624019b2a3f2f63_JaffaCakes118.dll2⤵PID:2704
-