Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 14:05
Behavioral task
behavioral1
Sample
5c41c533577c1bc95ae4c25f3b31822d_JaffaCakes118.dll
Resource
win7-20240705-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c41c533577c1bc95ae4c25f3b31822d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
5c41c533577c1bc95ae4c25f3b31822d_JaffaCakes118.dll
-
Size
58KB
-
MD5
5c41c533577c1bc95ae4c25f3b31822d
-
SHA1
89834d6bb93f63cab34f4a1ff6125f95a6cc9a22
-
SHA256
9604478fe619a7837a33bf91ae46636d9730d40ec5ae08abc0be721fe9229431
-
SHA512
44c3a0fda1c7bf777c755ff8161d510434698ddf46467d7d8bd2f952a7e866f274f7258425110976936f6e74dd500cd866e34305d0ff5c18431be262fe5e050b
-
SSDEEP
1536:EGryO+/nSi7igAX7FHJ7A2AZv1+L1hGuiyo:EGrz+/S/PHJ7A2AZNU7o
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3024-0-0x0000000010000000-0x000000001000D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 264 wrote to memory of 3024 264 rundll32.exe 30 PID 264 wrote to memory of 3024 264 rundll32.exe 30 PID 264 wrote to memory of 3024 264 rundll32.exe 30 PID 264 wrote to memory of 3024 264 rundll32.exe 30 PID 264 wrote to memory of 3024 264 rundll32.exe 30 PID 264 wrote to memory of 3024 264 rundll32.exe 30 PID 264 wrote to memory of 3024 264 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c41c533577c1bc95ae4c25f3b31822d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c41c533577c1bc95ae4c25f3b31822d_JaffaCakes118.dll,#12⤵PID:3024
-