Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 05:06

General

  • Target

    286badfb21674a5cb0ad18ee4511e741_JaffaCakes118.dll

  • Size

    278KB

  • MD5

    286badfb21674a5cb0ad18ee4511e741

  • SHA1

    35952a2d7c3a048004bcaaef4e80b6a02a013172

  • SHA256

    0660811219f91b6713e12cfc70ee06b0d4abcd03825c919094a7b0b1034afd5c

  • SHA512

    b04e4472777f0cc3b28112ff99cf49b06eca3aeb46d770145aafdc2c4b9cdb7706ffad3959a8cd3585fe9f5eae9e8b1a0eb7bf1cd9e5cedeee9f1078c0e77718

  • SSDEEP

    3072:TfcmhLlsosuE23UtV3s7wuBlCwjHdixnibVWajAnP0gQyez6Xjt6AlWEZ7Tfd5nd:TUmhJ/su3UPqXdiPa+0dZOTt6AToEiY

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\286badfb21674a5cb0ad18ee4511e741_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\286badfb21674a5cb0ad18ee4511e741_JaffaCakes118.dll
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads