Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll
-
Size
83KB
-
MD5
4365bf4b9b13356a58afde1d161742d7
-
SHA1
cbcca7255daf85b51ec87c99503a2b31e85aa84e
-
SHA256
ad07f0bc934d90322e44a261c3b062cfede77c3a7f4913d51a78dd9436d29b79
-
SHA512
73fc5ff6b79b954889c9b4aeab2c640351a65d66ec5fe536603443d20f860e55a1e385e9867c4715336c611507ebd282a74672f0c2d885ed45c461f1db99ccc4
-
SSDEEP
1536:pL+sGD81j+U6abMt4bERgmLwJGpGGClbvNxIyQFWj8cKnP6:vGW6LbGmLKGg/lb7YoZKP
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2952 3996 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3996 3176 rundll32.exe 83 PID 3176 wrote to memory of 3996 3176 rundll32.exe 83 PID 3176 wrote to memory of 3996 3176 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4365bf4b9b13356a58afde1d161742d7_JaffaCakes118.dll,#12⤵PID:3996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 5603⤵
- Program crash
PID:2952
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3996 -ip 39961⤵PID:1628