Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
-
Size
40KB
-
MD5
60ab94cdcb872632ce20f0a60f2d96f6
-
SHA1
034a5962ac65e35ca4090bff7a47b3a80fd1cccd
-
SHA256
5ef353e439dbf47b6cea65fb54e97c5bae49b1e8800bb3dae365270520d215a3
-
SHA512
8990fefd561baa47bf1dc63a916e0222ac4c7bc85515c0397540ef406e3dac05cf4473f832f012cefcb48a3db719ec811ed0493f73b93be92ca82982fe15d3cb
-
SSDEEP
768:jBsdD5cLCLHoQFmFMK2XUymw2nrpkavDWgLa16XW/h:xuDo6M5Zym8QzLabJ
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 Rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2368 Rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2624 wrote to memory of 2820 2624 regsvr32.exe 30 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31 PID 2820 wrote to memory of 2368 2820 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Rundll32.exeC:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll,DllUnregisterServer3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2368
-
-