Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
-
Size
83KB
-
MD5
4365bf4b9b13356a58afde1d161742d7
-
SHA1
cbcca7255daf85b51ec87c99503a2b31e85aa84e
-
SHA256
ad07f0bc934d90322e44a261c3b062cfede77c3a7f4913d51a78dd9436d29b79
-
SHA512
73fc5ff6b79b954889c9b4aeab2c640351a65d66ec5fe536603443d20f860e55a1e385e9867c4715336c611507ebd282a74672f0c2d885ed45c461f1db99ccc4
-
SSDEEP
1536:pL+sGD81j+U6abMt4bERgmLwJGpGGClbvNxIyQFWj8cKnP6:vGW6LbGmLKGg/lb7YoZKP
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3056 3044 rundll32.exe 29 PID 3044 wrote to memory of 3056 3044 rundll32.exe 29 PID 3044 wrote to memory of 3056 3044 rundll32.exe 29 PID 3044 wrote to memory of 3056 3044 rundll32.exe 29 PID 3044 wrote to memory of 3056 3044 rundll32.exe 29 PID 3044 wrote to memory of 3056 3044 rundll32.exe 29 PID 3044 wrote to memory of 3056 3044 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#12⤵PID:3056
-