Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll
-
Size
322KB
-
MD5
42294ecb2e499533c8db16025cc901b6
-
SHA1
baa6d0c81cbdb5a5e6bb2699f0917bb40c9569f0
-
SHA256
fbd6416060e3d446088838ec17fdc5b2238e76689956a5e6dd01091e77dba81f
-
SHA512
0cda76436352cc3a30a1adb33f55a608e158fb4599859be5c9fcca1d22bf909bd3d0100ffb0a22c098e515ec98cbc57bb4d5fab36448b94a2df0ec88cca140af
-
SSDEEP
3072:pXP/MN1yX++VjZf5gGmXKlOJ7UgiypovUjBlk8LKXknmi/HljH+G5MLBAxn25TWu:pf03yX++VjZm6sd74i/4GLnYyYDJXT
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 1036 4704 WerFault.exe 83 944 4704 WerFault.exe 83 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4704 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4704 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4704 4544 rundll32.exe 83 PID 4544 wrote to memory of 4704 4544 rundll32.exe 83 PID 4544 wrote to memory of 4704 4544 rundll32.exe 83 PID 4704 wrote to memory of 380 4704 rundll32.exe 88 PID 4704 wrote to memory of 380 4704 rundll32.exe 88 PID 4704 wrote to memory of 380 4704 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\42294ecb2e499533c8db16025cc901b6_JaffaCakes118.dll,#12⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 8403⤵
- Program crash
PID:1036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 6443⤵
- Program crash
PID:944
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4704 -ip 47041⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4704 -ip 47041⤵PID:4876