Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 03:54
Static task
static1
Behavioral task
behavioral1
Sample
33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll
-
Size
83KB
-
MD5
33350ca6c12540812d8d9c7d823aa6a4
-
SHA1
3486ef7ebac82bcd807dd395d279f47122b3bad1
-
SHA256
80d5d7028b2e0b736f03cc43b347f416f3c65d1576f84a85e5aabb16f52592d8
-
SHA512
9e0842ee0e2866775b0aab3dd2126b95ea3c08d812a3d8c9b7dea9973996b2f0acb01b1900ae63e2078dbcbe9d96da0bfab3081bc1e59d38967e5dda7dec0335
-
SSDEEP
1536:5HpeS2KXh9tDvXtz+Xv9egoLCLVNpxlqrcnwZIMBkeDG6ZE:5D2KXtD/F+gCpXecwZfB1DXZ
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2100-0-0x0000000000210000-0x000000000021E000-memory.dmp upx behavioral1/memory/2100-4-0x0000000000210000-0x000000000021E000-memory.dmp upx behavioral1/memory/2100-3-0x0000000000210000-0x000000000021E000-memory.dmp upx behavioral1/memory/2100-7-0x0000000000210000-0x000000000021E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2100 2000 rundll32.exe 30 PID 2000 wrote to memory of 2100 2000 rundll32.exe 30 PID 2000 wrote to memory of 2100 2000 rundll32.exe 30 PID 2000 wrote to memory of 2100 2000 rundll32.exe 30 PID 2000 wrote to memory of 2100 2000 rundll32.exe 30 PID 2000 wrote to memory of 2100 2000 rundll32.exe 30 PID 2000 wrote to memory of 2100 2000 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33350ca6c12540812d8d9c7d823aa6a4_JaffaCakes118.dll,#12⤵PID:2100
-