Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll
-
Size
51KB
-
MD5
2e4fe2331d9f5fa9acb5465b974b8311
-
SHA1
e2db75ae0c9158c52d843a8add21f2bb5d1b3fe2
-
SHA256
1e9619009e4970251461923fca29fbe0891fa47185175dcb5b18c1d6749a1077
-
SHA512
40db2b68ab8206219ce9fc8ee122f2b47087f96f4c924e663a03330eb7163c36d5e1f7c5d36ee5dc0f50d0e58fb3fd86ad2357a64509e3128e3647a060d6b0be
-
SSDEEP
768:Vq/Wj6Q3HgmbYkJnQ0ErnvZhX1uBSzm9DUDYK18z2/Hvl2Fi2bWn8AaOcI6Hv:YWjD3Hgvkl+xcSzm9sYKZJSWn8AaDIM
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\gopakibi.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\botejora rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3460 rundll32.exe 3460 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3876 wrote to memory of 3460 3876 rundll32.exe 82 PID 3876 wrote to memory of 3460 3876 rundll32.exe 82 PID 3876 wrote to memory of 3460 3876 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e4fe2331d9f5fa9acb5465b974b8311_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3460
-