Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 04:10
Static task
static1
Behavioral task
behavioral1
Sample
3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll
-
Size
36KB
-
MD5
3beffdc3d99d8d29c009e50c24580eac
-
SHA1
b813ef675965fbe810c5eb241091d76a7e655bb0
-
SHA256
d76b855ff48d1553ec5ce429603e306ae19699373d80d2fcba7f9eecfa127fd9
-
SHA512
bd4ae264c5a2f0ada149a0680d601ec18bd1e78b614191314755528f791016b49f5d3e3dd762d7d77f85991451d4a5b9ff06541f6046d35586dab7f90332a0c4
-
SSDEEP
768:P1jT7mkOoqXa88lhAQ0+TAs+Ckw3UAr5AB9aDG9BKipipGH8:P1jyoqq88yI+CDP6jkGiX
Malware Config
Signatures
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1332 wrote to memory of 3052 1332 rundll32.exe 83 PID 1332 wrote to memory of 3052 1332 rundll32.exe 83 PID 1332 wrote to memory of 3052 1332 rundll32.exe 83 PID 3052 wrote to memory of 724 3052 rundll32.exe 86 PID 3052 wrote to memory of 724 3052 rundll32.exe 86 PID 3052 wrote to memory of 724 3052 rundll32.exe 86 PID 724 wrote to memory of 1136 724 net.exe 88 PID 724 wrote to memory of 1136 724 net.exe 88 PID 724 wrote to memory of 1136 724 net.exe 88 PID 3052 wrote to memory of 4352 3052 rundll32.exe 89 PID 3052 wrote to memory of 4352 3052 rundll32.exe 89 PID 3052 wrote to memory of 4352 3052 rundll32.exe 89 PID 4352 wrote to memory of 2232 4352 net.exe 91 PID 4352 wrote to memory of 2232 4352 net.exe 91 PID 4352 wrote to memory of 2232 4352 net.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3beffdc3d99d8d29c009e50c24580eac_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\net.exenet stop winss3⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop winss4⤵PID:1136
-
-
-
C:\Windows\SysWOW64\net.exenet stop OcHealthMon3⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OcHealthMon4⤵PID:2232
-
-
-