Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
61bfc1ab67a4af810d1a3d34c3d95017_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
61bfc1ab67a4af810d1a3d34c3d95017_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
61bfc1ab67a4af810d1a3d34c3d95017_JaffaCakes118.dll
-
Size
380KB
-
MD5
61bfc1ab67a4af810d1a3d34c3d95017
-
SHA1
dbbcd4b1b327f7ae90536bc7622e02ec1e0ea6cd
-
SHA256
3daf7da72270c6bd6328712314982e50d74f8fe0e4ead98c1789a83899e86891
-
SHA512
44ffbbebcc412235855503f18b0013801556a470e95f95202ee31204c13ffbb4ed8d19affa89867aaef1eb4b521fd94ae37013e3541d079148468ab936b13f65
-
SSDEEP
6144:RSJOZphKt/jm5w60EC3w1WVqmv+dTVv5jELKumg1lvjSrzfjxW+:RSJOZpq/K5w60ECocqmvyTVB4sSvEzff
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\38deaa rundll32.exe File created C:\Windows\SysWOW64\-106-97429 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2012 2372 rundll32.exe 31 PID 2372 wrote to memory of 2012 2372 rundll32.exe 31 PID 2372 wrote to memory of 2012 2372 rundll32.exe 31 PID 2372 wrote to memory of 2012 2372 rundll32.exe 31 PID 2372 wrote to memory of 2012 2372 rundll32.exe 31 PID 2372 wrote to memory of 2012 2372 rundll32.exe 31 PID 2372 wrote to memory of 2012 2372 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61bfc1ab67a4af810d1a3d34c3d95017_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61bfc1ab67a4af810d1a3d34c3d95017_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:2012
-