Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll
-
Size
30KB
-
MD5
451dee7d1344de2071287178caf4f7f7
-
SHA1
519641dadd285f455ff2a5ba1b85ede9f28f72da
-
SHA256
0d952445bedb2b5fcdc14105f31aa4322b5f0284c33e3cfe871cf789a1515fef
-
SHA512
08335113a5ec0ba6b7ba37b98360a7de169fc6e992575d5266ec5075cf73473e7a7d0a7cae13a067c7719529793595fbb5d5de44b5b5ac79b513abcbc814c376
-
SSDEEP
384:K59+PbhI7kZp9W/ACSrRqA2BKg31GztPnuGy1gjM38HxAw09qbs8sIHvB0N5B:y+ThI7G/hv2IBPuG8gjrJ09Sswvm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 828 wrote to memory of 5056 828 regsvr32.exe 83 PID 828 wrote to memory of 5056 828 regsvr32.exe 83 PID 828 wrote to memory of 5056 828 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\451dee7d1344de2071287178caf4f7f7_JaffaCakes118.dll2⤵PID:5056
-