Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll
-
Size
137KB
-
MD5
5bdaf23675c065e4bfed63fae0a01379
-
SHA1
53d2997dc3359a78de761c748c4054b7f14ba015
-
SHA256
0c6eba4815b80e83f908208d80df0142e960d38904ef9cebe718d1c0bd89ccc6
-
SHA512
7b9b9b5c50dde6b92591f6d9df858af9a356c4a2fab4c1dd5dce4e07fadb96f045f7ec8b9d832d0b452f2639597a46c5688bf383f3b56dc121835e934daef8e1
-
SSDEEP
3072:8BhE7pCpDPT8iqc1OBWtaMm9i8WSeNm+U7lDhX9z:8BhMp8Dgiq5M2W74xhtz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4104 4956 rundll32.exe 84 PID 4956 wrote to memory of 4104 4956 rundll32.exe 84 PID 4956 wrote to memory of 4104 4956 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5bdaf23675c065e4bfed63fae0a01379_JaffaCakes118.dll,#12⤵PID:4104
-