Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll
-
Size
97KB
-
MD5
5fc344fe50f3b7654c72ada19b17c841
-
SHA1
87042774e8ed723a394f3f3f65168380600e1dc6
-
SHA256
bec5ea2899786abb9f9e335896c81bfa51cf6f659beae15a9a8c030a755ab4f0
-
SHA512
8c138452bc54eaabf9fd1e662e403e6645ad19030ca9f6b726f89b0c249693e7ed4d53e19d0986b157ead421ad9a4732185b4040df55b21a7f89b2d13b85eb0c
-
SSDEEP
1536:JA6stcQ6tj4s5B+Fc+rvlUyJkRhpUvpCAh+osaGkL5nDhFo0Cr0:JA6si1t6c6NUymXxo/GkL5nDhWm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4484 wrote to memory of 4044 4484 rundll32.exe 84 PID 4484 wrote to memory of 4044 4484 rundll32.exe 84 PID 4484 wrote to memory of 4044 4484 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc344fe50f3b7654c72ada19b17c841_JaffaCakes118.dll,#12⤵PID:4044
-