Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll
-
Size
40KB
-
MD5
3db595c3650109b51f7e3c74c7f946b3
-
SHA1
4e6a397875bdaf374bc38fc4fe1c47dbc2a6f26f
-
SHA256
a6fd05d4527eb7d8168b35d7672d51128ff2949fe4ff64f73ebdf9a7557c8ac4
-
SHA512
36367578e4d8e90832df165992bfcd0c97e402823a33a7692a7ab6117a43c6d032a5c05cbf18aea808b77a552c42d5ba378dccf456cd6632be55c26cae1248bb
-
SSDEEP
384:aXN310jDOzhlK/nvt5YOyCR0pwE42xKh5HiKHCbyrLB+hL5CRqkmj3Uucm:aN3iDSlK/nxqpwQxXKHC+L4+Rmj3Uuc
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2760 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2760 2764 rundll32.exe 30 PID 2764 wrote to memory of 2760 2764 rundll32.exe 30 PID 2764 wrote to memory of 2760 2764 rundll32.exe 30 PID 2764 wrote to memory of 2760 2764 rundll32.exe 30 PID 2764 wrote to memory of 2760 2764 rundll32.exe 30 PID 2764 wrote to memory of 2760 2764 rundll32.exe 30 PID 2764 wrote to memory of 2760 2764 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3db595c3650109b51f7e3c74c7f946b3_JaffaCakes118.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2760
-