Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll
Resource
win7-20240705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll
Resource
win10v2004-20240704-en
1 signatures
150 seconds
General
-
Target
2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll
-
Size
124KB
-
MD5
2cd1785f39e295a02ff289912ba5b5da
-
SHA1
0a573a96e1b86c334c2bdfbf30ed6d0656e79c32
-
SHA256
450aa9da5d6d05c7d5f8a15beb3b9605ef0a35415c164c1a52304d0d133ca936
-
SHA512
cb4c1d4d52dd9075aaae5ad4775dc3969d0237f5ed110b17ad1702049b876cb4b2dead067e7e256b53c41d152b1ac8c6584046d1c366c9a56e0cc28342a0f07d
-
SSDEEP
3072:v/52cSj1+PQahVfec0Ts/5Fa/rpGOvzNUko7:xs+XT/0Ts/5FFOzS
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4752 wrote to memory of 3612 4752 regsvr32.exe 82 PID 4752 wrote to memory of 3612 4752 regsvr32.exe 82 PID 4752 wrote to memory of 3612 4752 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2cd1785f39e295a02ff289912ba5b5da_JaffaCakes118.dll2⤵PID:3612
-