Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 00:44
Behavioral task
behavioral1
Sample
3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll
Resource
win7-20240705-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll
-
Size
98KB
-
MD5
3710c5892ee32991ea06ccb691896f8b
-
SHA1
c13f0ce3533034c43b3258dece3a9818b8cfc301
-
SHA256
8509ec4fc6f20acce660a1f5684e54fee3e0b41502648a06a41d60767bcf181a
-
SHA512
0f32ec768116fc609d0e93f74ed1f8c50835de46720613eafe2204fea7934886ed2868fa2c55f8bd2a83f6a77aad1a0432973295d87a04f20e5c418ad5b22ee0
-
SSDEEP
1536:Zn4Mi33LS7enDxB4eJO26Mgz12hhrLRwbf0uzdZzPp3cvEjJ3fIlnq:Zfi3b8enD34+O9MAQhJCIgd5mqJ3onq
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/356-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3036 wrote to memory of 356 3036 rundll32.exe 30 PID 3036 wrote to memory of 356 3036 rundll32.exe 30 PID 3036 wrote to memory of 356 3036 rundll32.exe 30 PID 3036 wrote to memory of 356 3036 rundll32.exe 30 PID 3036 wrote to memory of 356 3036 rundll32.exe 30 PID 3036 wrote to memory of 356 3036 rundll32.exe 30 PID 3036 wrote to memory of 356 3036 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3710c5892ee32991ea06ccb691896f8b_JaffaCakes118.dll,#12⤵PID:356
-