Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll
-
Size
244KB
-
MD5
4232fca300d7e37eaccf990a40fe9c83
-
SHA1
227e5ed419498f04f27bc0840f0134e74a22e826
-
SHA256
c9b4685185e0f998c9389bb1756c5e741c21cbbbce78fd33b0c4d44b49de5f5e
-
SHA512
eefabdbc62fc1eb2db001ae525516dccf8226abf4f43d5b114dfe8cc31c46b920c69bb9a5594c65bee20ae35e41cbd1d00ce07738084c906abcf2e25caf6755a
-
SSDEEP
6144:a6Ib0YtxWuar6klk+bLOsbzSjlsyhGOotpd0rFOYn:Mb0YtUuKxkmisbzSpsyhM4
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3620 400 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3224 wrote to memory of 400 3224 rundll32.exe 83 PID 3224 wrote to memory of 400 3224 rundll32.exe 83 PID 3224 wrote to memory of 400 3224 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4232fca300d7e37eaccf990a40fe9c83_JaffaCakes118.dll,#12⤵PID:400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 5723⤵
- Program crash
PID:3620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 4001⤵PID:3504