Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 06:08
Static task
static1
Behavioral task
behavioral1
Sample
666c58dd41912cdd9e59551791319852_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
666c58dd41912cdd9e59551791319852_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
666c58dd41912cdd9e59551791319852_JaffaCakes118.dll
-
Size
16KB
-
MD5
666c58dd41912cdd9e59551791319852
-
SHA1
4225f5d0ab7fb736338578afa5a0f3b469f9a68c
-
SHA256
f202c26a83e93cd75c462a49847db11cc39a289fc5d7bbd481a40c92cc1351f1
-
SHA512
83ed522ecf8fc1e834de839b5f5a7c9b3913e022c03abaa8b30f5052ceaf226054f659bf763faf3e6dae0ea00eeb2b838ee9d8e780740b385c728b7a17e9ae3b
-
SSDEEP
192:DG93JrcCNXQSi084aYgwgvSLtyxOq26mLBcbjyafAVkn5KqDDd2fIAmPzbWjM2F:DGvPX7V9ax/KZyxODAyaIw5zDuUKPF
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1016 wrote to memory of 1256 1016 rundll32.exe 84 PID 1016 wrote to memory of 1256 1016 rundll32.exe 84 PID 1016 wrote to memory of 1256 1016 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\666c58dd41912cdd9e59551791319852_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\666c58dd41912cdd9e59551791319852_JaffaCakes118.dll,#12⤵PID:1256
-