Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
2e9406fe44340b2b104a334bf07cddf6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2e9406fe44340b2b104a334bf07cddf6_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2e9406fe44340b2b104a334bf07cddf6_JaffaCakes118.dll
-
Size
1.1MB
-
MD5
2e9406fe44340b2b104a334bf07cddf6
-
SHA1
63632dd3db89fff9962ff63676dfc6123cf80f54
-
SHA256
557f0d2bfccadefa4bc53d12eddbf0b791cb51adcc04869999fcd2bb0e1f10e3
-
SHA512
ba0cdcee0e0a00c5eb51c231eb432a8924411b96978d5a6b157427ee15073264e9badf0ab4ca0297382a3e797c30ca1f6fc48f87d8b0a2652af044038e998643
-
SSDEEP
24576:SMpZ4OxwR1QcQq/W7ihb4bPWmBLXvPmVpTrdzjs00E:SuNZ7Ib8ZBL2/Xj
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dticem\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2e9406fe44340b2b104a334bf07cddf6_JaffaCakes118.dll" regsvr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\5650bcea56.dll svchost.exe File opened for modification C:\Windows\SysWOW64\5650bcea56.dll svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4912 wrote to memory of 1572 4912 regsvr32.exe 89 PID 4912 wrote to memory of 1572 4912 regsvr32.exe 89 PID 4912 wrote to memory of 1572 4912 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e9406fe44340b2b104a334bf07cddf6_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2e9406fe44340b2b104a334bf07cddf6_JaffaCakes118.dll2⤵
- Server Software Component: Terminal Services DLL
PID:1572
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k dtcGep -s dticem1⤵
- Drops file in System32 directory
PID:3920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4328,i,18101465343131957040,13619216624229484913,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:81⤵PID:3028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD5a789ce256cfc662347faf1e2b13bc5bb
SHA1350389eee31a0808442a623e0fee8b998a062618
SHA25693effa6ec55dfb27444f87fec0589fb72544e5d808498ca76b585786c92ba73b
SHA512f36ba6f785aa36f7031f3f73f7190d14e451f291a00d80af458b387655389bf3cecd86b6dfb92cacf8457eebea45196df299b57155b64c451571a1430eb49908