Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll
-
Size
93KB
-
MD5
3017314a350e58fdcf982b7addfaf5b6
-
SHA1
9f642c98f31d8e2c09ccac992d1b149b3ed999c1
-
SHA256
4a4005f955ce0d96918576ce01100dd54589df25088c89e7b63109077eb6fc4f
-
SHA512
ac852786cab6e2de45357f9aa96b591d3de18ac3fbf4e16685dd4ded202662037a950ad6f6953f219ecb5b9d4c1790c7ccf5b749ab8e1b95a12490d6d53170f3
-
SSDEEP
1536:5yHblcgCPIBQOicuI/dU/ZoqPsuj4QfGjOpr/nX1MBRoYHA6oR:4HbDKCoqdU/ZBEQf9MBry
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2364 2220 WerFault.exe 31 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2212 wrote to memory of 2220 2212 rundll32.exe 31 PID 2220 wrote to memory of 2364 2220 rundll32.exe 32 PID 2220 wrote to memory of 2364 2220 rundll32.exe 32 PID 2220 wrote to memory of 2364 2220 rundll32.exe 32 PID 2220 wrote to memory of 2364 2220 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3017314a350e58fdcf982b7addfaf5b6_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 2643⤵
- Program crash
PID:2364
-
-