Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
65f2fc5aa0687bb13ea45b1a1e1d4f17_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65f2fc5aa0687bb13ea45b1a1e1d4f17_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
65f2fc5aa0687bb13ea45b1a1e1d4f17_JaffaCakes118.dll
-
Size
26KB
-
MD5
65f2fc5aa0687bb13ea45b1a1e1d4f17
-
SHA1
bff4d463d466816b1ef86845bd207f80d541c1a3
-
SHA256
297934fa288303595eeccc93e0b65648493416d5f1d30153fca43b1cd4eb68d9
-
SHA512
cf68ba197b5c51701640768e484f8910eb0676b3a818281f51d84b62c61a5d6939a87fe325a47629237386efe4b30d552824beecbb0cc430a3a9c64c7d085c59
-
SSDEEP
384:45m008E9N4NJI9LmFKZxGvAEio77bicN8oN3vZa7xh2RaRLwg7Pd:3008NI9LpZxG8o7KcuoBQ7PfRMg7Pd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4504 wrote to memory of 2644 4504 rundll32.exe 84 PID 4504 wrote to memory of 2644 4504 rundll32.exe 84 PID 4504 wrote to memory of 2644 4504 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65f2fc5aa0687bb13ea45b1a1e1d4f17_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\65f2fc5aa0687bb13ea45b1a1e1d4f17_JaffaCakes118.dll,#12⤵PID:2644
-