Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12/07/2024, 18:23

General

  • Target

    3e64576f8a0255a599a042c5188bad84_JaffaCakes118.dll

  • Size

    118KB

  • MD5

    3e64576f8a0255a599a042c5188bad84

  • SHA1

    015431caac6c5b7471aa76bd6380aa5bf0ecb41f

  • SHA256

    8225c700412996b75febdf820b0b28d1b1c9a44ef67c958a3bb61b15ce9eae38

  • SHA512

    858f92d2f067043ef2b86b028fd23d8d3b9b5a75669893bb686b9d0891878ee973a208ebe9a39a3a1d60b073dcf2320753a361fe368a45fc2999835e6d01fbdc

  • SSDEEP

    3072:OiritaPJKqYwaubkNUtba7tYACr1/8/rTOCkr4zJrSiazb:VrisxKZwaub/QlOC44hwb

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1228
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e64576f8a0255a599a042c5188bad84_JaffaCakes118.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e64576f8a0255a599a042c5188bad84_JaffaCakes118.dll,#1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1932

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1228-3-0x0000000002B60000-0x0000000002B61000-memory.dmp

      Filesize

      4KB

    • memory/1932-2-0x0000000000230000-0x000000000025A000-memory.dmp

      Filesize

      168KB

    • memory/1932-0-0x0000000010000000-0x0000000010024000-memory.dmp

      Filesize

      144KB