Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll
-
Size
105KB
-
MD5
49ab8e42be2ac3bd8efc342a222b48ed
-
SHA1
4e2d168d113c905c1791f4f5d0c8bd3585a52e7a
-
SHA256
40ffda8d8cb1311a91bfb6cc164f0b5ce3f0605846d5d9db4fd9dcaad1b2975e
-
SHA512
fde783a95e40bdcbea98b7433b31277b7c6ea1869429ddc7a0d7efb2e8ccf720731d6a6bdbba95e460e4da5af38a59f456cd2adf177cf6a50409987b6914e419
-
SSDEEP
1536:DMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRBemxQ6ph5l:D5OK1bzWkokkkkkkcVUwooRUmx3
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30 PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30 PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30 PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30 PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30 PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30 PID 2260 wrote to memory of 2644 2260 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\49ab8e42be2ac3bd8efc342a222b48ed_JaffaCakes118.dll2⤵PID:2644
-