Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 11:17
Static task
static1
Behavioral task
behavioral1
Sample
38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll
-
Size
6KB
-
MD5
38e3cb8eaf6eeaf85d3877bc0a2cbfc8
-
SHA1
2919147d3b69ddb69eb9186d084e0bd635245966
-
SHA256
9a7985de3e12b583097d1606e50e91adc8a057fb24c3a6ed5395bb0fecc970a1
-
SHA512
c62c3e223afcd4dacf4e8a48587eb99d2444beea8120a4b6aaef30e5491505373e181f95cb82c0337e7ac3c0061ed86e6334110713f2e96773a50230b8dabff0
-
SSDEEP
48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1732 1928 rundll32.exe 30 PID 1928 wrote to memory of 1732 1928 rundll32.exe 30 PID 1928 wrote to memory of 1732 1928 rundll32.exe 30 PID 1928 wrote to memory of 1732 1928 rundll32.exe 30 PID 1928 wrote to memory of 1732 1928 rundll32.exe 30 PID 1928 wrote to memory of 1732 1928 rundll32.exe 30 PID 1928 wrote to memory of 1732 1928 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\38e3cb8eaf6eeaf85d3877bc0a2cbfc8_JaffaCakes118.dll,#12⤵PID:1732
-