Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 01:10
Behavioral task
behavioral1
Sample
59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll
Resource
win7-20240704-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll
-
Size
66KB
-
MD5
59db2e9184e41582c7fb90544b91009a
-
SHA1
0ec1b9ea3189383e2e7cf3185e76a8af367043df
-
SHA256
159a41b340d769a949d78c98a989d101fd262e0f6efbd71df4bab30171207da0
-
SHA512
23c83bddb4c880de452cf9e33dc1124d5869c70b20785b522d99beaa0c92b7c11470b31c1df774234c4a831e493ba54b5459c62c61ad0bc5cb9d8aa547c9d31a
-
SSDEEP
1536:DVV1HTV0b59r6zRrmTy44IICnFVCiNAyLrD/v72F+EpdEKE3uNf:DVrmT6QWIICCiNdb7dsdfE3uR
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2860-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2860 2700 rundll32.exe 30 PID 2700 wrote to memory of 2860 2700 rundll32.exe 30 PID 2700 wrote to memory of 2860 2700 rundll32.exe 30 PID 2700 wrote to memory of 2860 2700 rundll32.exe 30 PID 2700 wrote to memory of 2860 2700 rundll32.exe 30 PID 2700 wrote to memory of 2860 2700 rundll32.exe 30 PID 2700 wrote to memory of 2860 2700 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59db2e9184e41582c7fb90544b91009a_JaffaCakes118.dll,#12⤵PID:2860
-