Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll
-
Size
628KB
-
MD5
67ca12aded9c52cb0b082115a56cacb7
-
SHA1
227bc17efa54edada9f4d102c18b6383c2145d9d
-
SHA256
08e572a87c7813efbef25e9f9a324eab9b81c1df2eae68c7140ddfe55cd88e53
-
SHA512
9c24b1ec8c4fab0233042cbc0402b85e34a321e332611497c1bf7f12f26ae7bfbd361137e091ff86b51ca548ff0262094f62a71044e964c2cc6554e92ead52a2
-
SSDEEP
12288:aXN+j2hor0tDRNtIuH0of9WTUKsbqbGkMME23:aXXhc0t17IuH0ofSUKsbIM323
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4832 3852 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3824 wrote to memory of 3852 3824 regsvr32.exe 84 PID 3824 wrote to memory of 3852 3824 regsvr32.exe 84 PID 3824 wrote to memory of 3852 3824 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\67ca12aded9c52cb0b082115a56cacb7_JaffaCakes118.dll2⤵PID:3852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 7403⤵
- Program crash
PID:4832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3852 -ip 38521⤵PID:1244