Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll
-
Size
280KB
-
MD5
4bd05e94729b807e31a92efa6ca9a5ce
-
SHA1
8c88e2b5d55992b422d94d9dc2476c85eb9ea393
-
SHA256
8c861c71ddc9e947e47f5bc62d7b673e3d96b557ceedbdf5f7ac336819a2fac6
-
SHA512
bf25eea60e108e677155495a5d639f2eaa194d26e255f690963bbf929d96c66812d27136177dd619f4e9b67e4c1b03fb0dbbf1a64634dd45b8dacb013824e757
-
SSDEEP
3072:fY6z8zVBPrOWOdgwYH5McNr3N96s7yV+L4lqw25YA5prBo37P+05vvtLnCwasK3e:J8XOFdiHKWXc7P+ChfKO
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2664 2636 rundll32.exe 30 PID 2636 wrote to memory of 2664 2636 rundll32.exe 30 PID 2636 wrote to memory of 2664 2636 rundll32.exe 30 PID 2636 wrote to memory of 2664 2636 rundll32.exe 30 PID 2636 wrote to memory of 2664 2636 rundll32.exe 30 PID 2636 wrote to memory of 2664 2636 rundll32.exe 30 PID 2636 wrote to memory of 2664 2636 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd05e94729b807e31a92efa6ca9a5ce_JaffaCakes118.dll,#12⤵PID:2664
-