Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 08:30

General

  • Target

    1976187ba49108669682ffff927e417a_JaffaCakes118.dll

  • Size

    3.7MB

  • MD5

    1976187ba49108669682ffff927e417a

  • SHA1

    e75394263922f301ffb9f95621343877258771e1

  • SHA256

    9d9259e092e2c0d04668acff35f7dba53ced1037e3389fb457967f50454e85dc

  • SHA512

    0a270686db1897d8cb82dcb5eb824162264f5298cd6eb0fc386593566a206f9bc882d5a42efe27910b097735ff9dbf16a63eb6746d4795cf6566cc493c674275

  • SSDEEP

    6144:CWqcbsqA/Yiaf9qRGDfTJd9WYXmHPocXz2v/64UgP1toJI:pbsqA/zc4RG5aYIFK64UgPvoS

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1976187ba49108669682ffff927e417a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1976187ba49108669682ffff927e417a_JaffaCakes118.dll,#1
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\ebxjeevp.dll

    Filesize

    4.8MB

    MD5

    667bf038e5b76d79be1300f1a73a2753

    SHA1

    1759d63594ba7504d63045bd882ae04ec88ca785

    SHA256

    dbbbedd138db9e5e0339b77531b9caaa83215f0e1e05643ed6515f7a809b4209

    SHA512

    cbcf7808d908f205c7960c15276139f40bb98d016aaa8cf95d320da01708bb672888cebffabfb364cd54ce5ff98cdd5917ac20cb79811187680cc9038713d65b

  • memory/2220-0-0x00000000006B0000-0x00000000006FE000-memory.dmp

    Filesize

    312KB

  • memory/2220-2-0x0000000000840000-0x0000000000895000-memory.dmp

    Filesize

    340KB

  • memory/2220-8-0x00000000001A0000-0x00000000001A7000-memory.dmp

    Filesize

    28KB

  • memory/2220-9-0x00000000001A0000-0x00000000001A7000-memory.dmp

    Filesize

    28KB

  • memory/2220-19-0x00000000008A0000-0x00000000008EE000-memory.dmp

    Filesize

    312KB

  • memory/2220-22-0x0000000002110000-0x0000000002165000-memory.dmp

    Filesize

    340KB

  • memory/2220-21-0x0000000002110000-0x0000000002165000-memory.dmp

    Filesize

    340KB

  • memory/2220-28-0x00000000001B0000-0x00000000001B7000-memory.dmp

    Filesize

    28KB

  • memory/2220-34-0x00000000006B0000-0x00000000006FE000-memory.dmp

    Filesize

    312KB

  • memory/2220-35-0x00000000008A0000-0x00000000008EE000-memory.dmp

    Filesize

    312KB