Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 23:29
Static task
static1
Behavioral task
behavioral1
Sample
326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll
-
Size
152KB
-
MD5
326ce3d5c4e0e5eb3ba51e48c4469381
-
SHA1
4557a3442d21dbd7b3472c32dd02a2e5d6fe832d
-
SHA256
0011ff95aeb4e78b6e5c0187bb2ee422d2a70bc33beb5716bdcaf2b844b52324
-
SHA512
f312c0d3e2f1b3f2aadf5c61433c68e30da3b77f9de713cad66257ec56d6040042b934d6b26f2a68a4d8a8a33e138ee2c10d1ae3f13fb634427b7c14b1adc117
-
SSDEEP
3072:7mSIInsd/35Yi5RXjigJhRmmheAAmMyZaifrOOMT:yS7sxpY+XjigLRReFbyZaiL
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4664 wrote to memory of 652 4664 regsvr32.exe 81 PID 4664 wrote to memory of 652 4664 regsvr32.exe 81 PID 4664 wrote to memory of 652 4664 regsvr32.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\326ce3d5c4e0e5eb3ba51e48c4469381_JaffaCakes118.dll2⤵PID:652
-