Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 22:30

General

  • Target

    3f20e720e7524150c936b5713080e5db_JaffaCakes118.dll

  • Size

    2.4MB

  • MD5

    3f20e720e7524150c936b5713080e5db

  • SHA1

    ba8365be723eb84b9851fa1c463eddf0fbe9c984

  • SHA256

    2df5fd4399743d28a09f808f4dac83d709c5d89d7dad5f8a1e16877c5f7084b5

  • SHA512

    af13a36f27753d1c9c0dc88c9435da5abbaa26a1c6754400d11374e9df29c10610cd340b8fe195db30a00ed85d840f74d30ed0df8c1d2d03d6e6eaf6f7e402d6

  • SSDEEP

    49152:qV29NIxruyJHAg4tV7eUFnpD5mQcY/cHcQY:vzIJnJg1VaUFpt7GH

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f20e720e7524150c936b5713080e5db_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f20e720e7524150c936b5713080e5db_JaffaCakes118.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads