Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 19:24

General

  • Target

    30a680c6952822156cdeac363fdc1a08_JaffaCakes118.dll

  • Size

    4.4MB

  • MD5

    30a680c6952822156cdeac363fdc1a08

  • SHA1

    8ec9a180333b893a8c3cb1b1e599470d6e5c1ae0

  • SHA256

    c797fbb83fce5acb22793e9f5ff135d47ae05eee8ad72ec005651330d75d3a04

  • SHA512

    7d8ce14c44a50fa63b1b683af0d0a23de278ff1b9b03fa8474391f065e4f34319bffd654422802025b96376a7613ec60c77ffdefaf1da9ac9db74b8596b68e71

  • SSDEEP

    98304:9vy0/7Jx/Bs7IsuC1Z2GP04sFetpaCcxMVc0XVHsZbkQyPBPl2:9vy0/7Jx/CIsuC1Z2GP04sFeIMG0aZbn

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\30a680c6952822156cdeac363fdc1a08_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\30a680c6952822156cdeac363fdc1a08_JaffaCakes118.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1704-2-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/1704-0-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/1704-4-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/1704-5-0x0000000074468000-0x0000000074648000-memory.dmp

    Filesize

    1.9MB

  • memory/1704-6-0x0000000074270000-0x00000000746E2000-memory.dmp

    Filesize

    4.4MB