Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll
Resource
win10v2004-20240704-en
1 signatures
150 seconds
General
-
Target
28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll
-
Size
32KB
-
MD5
28aa550f0f4837b58471a72b33ce9caf
-
SHA1
f01ad4ac1dcf3bbff44f6792569db11f81308bcc
-
SHA256
2c33ffd7d15297cddb7b93155847d2616d21a5db479dede08a502aa23304849f
-
SHA512
2b583001e3550d9e9d1cf53890ce0bc0135658b331e27bb5dc3a4bfe8e9f4feca8fe4411506b02eec4602cee62c92d24584e810203d2b9ef722e4bd7c1085ff4
-
SSDEEP
768:Kg/qQ5tk1RdmvWw7Ot+1kjWNqOmESRnZ+9b:Kg/D5a7dmX7OtUu3RZ+5
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2992 wrote to memory of 1796 2992 rundll32.exe 89 PID 2992 wrote to memory of 1796 2992 rundll32.exe 89 PID 2992 wrote to memory of 1796 2992 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28aa550f0f4837b58471a72b33ce9caf_JaffaCakes118.dll,#12⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,10426317566413639638,17907471819827662535,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:81⤵PID:3776