Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll
-
Size
14KB
-
MD5
39d2d80c37ca35115cd2d89a2835be86
-
SHA1
5ec6c0bf3f5abeb58a67b7a08399664f45ca90d7
-
SHA256
663535101fc03945538a207a02a699669730af39ef4adf719e38c399a4372f05
-
SHA512
f6650720bab3a0d12309677383d45115edc5e026fedd44cc3217d5ce618c225c988ac6fed0c872aa29c657ac1be56878d06ee63b87232529f078df21ecdb2e05
-
SSDEEP
192:0C5VoIj7fHahOPi6kNwBmzFgB451SAU69jSSDCweG/qHBTYCFZ9LQ:p5NH6/NwBmxQn6XDCo/qhcCz9U
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 844 wrote to memory of 2728 844 rundll32.exe 30 PID 844 wrote to memory of 2728 844 rundll32.exe 30 PID 844 wrote to memory of 2728 844 rundll32.exe 30 PID 844 wrote to memory of 2728 844 rundll32.exe 30 PID 844 wrote to memory of 2728 844 rundll32.exe 30 PID 844 wrote to memory of 2728 844 rundll32.exe 30 PID 844 wrote to memory of 2728 844 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39d2d80c37ca35115cd2d89a2835be86_JaffaCakes118.dll,#12⤵PID:2728
-