Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll
-
Size
80KB
-
MD5
2e84c56cd9fb4f96264e4eb63cbe445a
-
SHA1
3d8efda0825de5486835a97b0aede973c6296930
-
SHA256
c5589bb282f14c6d5a443ddb50f8931a7cec9b4eab0c4efbc636984c39a8b81c
-
SHA512
5d090c66586801c6d37613400a87368edbb00f3307725b54ad98fd098be3aabb8fd393009894f5f21683c836d6450eff109cb7d4c8444e456813bbfd2b7882de
-
SSDEEP
1536:bNqDQpy4BtEznCTS0/sti0onyZGOxI2s0ciXjK3mgfEzYTmeB8cW+tbueorU4Kj4:mCy47EIScKSy/xvs0cizK3mgfXzB8cT8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2456 wrote to memory of 4940 2456 regsvr32.exe 82 PID 2456 wrote to memory of 4940 2456 regsvr32.exe 82 PID 2456 wrote to memory of 4940 2456 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2e84c56cd9fb4f96264e4eb63cbe445a_JaffaCakes118.dll2⤵PID:4940
-