Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b12cd4da020be5d945c9bc9a508969e_JaffaCakes118.dll
Resource
win7-20240708-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b12cd4da020be5d945c9bc9a508969e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
4 signatures
150 seconds
General
-
Target
4b12cd4da020be5d945c9bc9a508969e_JaffaCakes118.dll
-
Size
17KB
-
MD5
4b12cd4da020be5d945c9bc9a508969e
-
SHA1
356df58fff57f286450961f15d00d5b9e4366216
-
SHA256
0adb76509e293c2230ea4d9889258bed689ce61834de3450f2ed886d4d53506d
-
SHA512
349116d3239d83536d40b314de86cd7f27a71e03c01300abd098298e481ec1dcf6102c0d6e4a819d7c431c1ed637c5af5a9d13530cede448692bd675b894237e
-
SSDEEP
384:5nnTcuRsgrH4NiHJ4akzXYZzay4a4ww0DDSf1:5nDKgrHuGCXO7V4ww0vE1
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\mseion.sys rundll32.exe File created C:\Windows\SysWOW64\msepbe.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\msepbe.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3872 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4624 wrote to memory of 3872 4624 rundll32.exe 82 PID 4624 wrote to memory of 3872 4624 rundll32.exe 82 PID 4624 wrote to memory of 3872 4624 rundll32.exe 82 PID 3872 wrote to memory of 3448 3872 rundll32.exe 55
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b12cd4da020be5d945c9bc9a508969e_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b12cd4da020be5d945c9bc9a508969e_JaffaCakes118.dll,#13⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872
-
-