Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 11:49
Static task
static1
Behavioral task
behavioral1
Sample
2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll
-
Size
25KB
-
MD5
2c3afc5b3c3a54290c478f645fd90364
-
SHA1
76960938b392dbbbcb405a141367e7196dff09db
-
SHA256
5308e1abfb01f4353b32403cb2c7f89116c42b19d0edfd27e426ee3cc56c317f
-
SHA512
d579cdee22134e756a52f4e03b24825e41b4c697b26d12fd3483e9e130ab3b31a3fe6bf94e32aaf01f7e74fe0488c5fa460d3e0c392189fa954040ac45cdc8fa
-
SSDEEP
384:EW5/p9P4FLcryiy2emca/QzFvdDh67OD7NFTLFIVDcW6GGKHBWYZyCYyk:EW5/pR4Sr5caIhvdDQ2QDn6cBtZS
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2080 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2080 2232 rundll32.exe 30 PID 2232 wrote to memory of 2080 2232 rundll32.exe 30 PID 2232 wrote to memory of 2080 2232 rundll32.exe 30 PID 2232 wrote to memory of 2080 2232 rundll32.exe 30 PID 2232 wrote to memory of 2080 2232 rundll32.exe 30 PID 2232 wrote to memory of 2080 2232 rundll32.exe 30 PID 2232 wrote to memory of 2080 2232 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c3afc5b3c3a54290c478f645fd90364_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2080
-