Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
-
Size
36KB
-
MD5
3beffdc3d99d8d29c009e50c24580eac
-
SHA1
b813ef675965fbe810c5eb241091d76a7e655bb0
-
SHA256
d76b855ff48d1553ec5ce429603e306ae19699373d80d2fcba7f9eecfa127fd9
-
SHA512
bd4ae264c5a2f0ada149a0680d601ec18bd1e78b614191314755528f791016b49f5d3e3dd762d7d77f85991451d4a5b9ff06541f6046d35586dab7f90332a0c4
-
SSDEEP
768:P1jT7mkOoqXa88lhAQ0+TAs+Ckw3UAr5AB9aDG9BKipipGH8:P1jyoqq88yI+CDP6jkGiX
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2416 1628 rundll32.exe 28 PID 1628 wrote to memory of 2416 1628 rundll32.exe 28 PID 1628 wrote to memory of 2416 1628 rundll32.exe 28 PID 1628 wrote to memory of 2416 1628 rundll32.exe 28 PID 1628 wrote to memory of 2416 1628 rundll32.exe 28 PID 1628 wrote to memory of 2416 1628 rundll32.exe 28 PID 1628 wrote to memory of 2416 1628 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#12⤵PID:2416
-