Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
6787d45c773ac18411cf76733e115bac_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6787d45c773ac18411cf76733e115bac_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6787d45c773ac18411cf76733e115bac_JaffaCakes118.dll
-
Size
412KB
-
MD5
6787d45c773ac18411cf76733e115bac
-
SHA1
1ae2cfa6eef07c95b7f6cb28f9e01d8ef7d6e65c
-
SHA256
f8515fb3d5d606a35ffdb0e11ae74e8b8cf92683ca6338f668c14ab1b4068d5f
-
SHA512
fa47ed15cf73fa955c53e812897ca8486236b039bf70431a663f4a72a68ad0e53a725545254cad053c8fb14e6222e1f9a59698ef6830251117d10fe91de4cd79
-
SSDEEP
12288:rYjUumb8gmsSJ4DtbGedMBdoUbsJSezLZi:rYoumjJLiByKs0ezVi
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\9525-65-60 rundll32.exe File created C:\Windows\SysWOW64\086 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2160 2644 rundll32.exe 30 PID 2644 wrote to memory of 2160 2644 rundll32.exe 30 PID 2644 wrote to memory of 2160 2644 rundll32.exe 30 PID 2644 wrote to memory of 2160 2644 rundll32.exe 30 PID 2644 wrote to memory of 2160 2644 rundll32.exe 30 PID 2644 wrote to memory of 2160 2644 rundll32.exe 30 PID 2644 wrote to memory of 2160 2644 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6787d45c773ac18411cf76733e115bac_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6787d45c773ac18411cf76733e115bac_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
PID:2160
-