Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 18:23

General

  • Target

    3e64576f8a0255a599a042c5188bad84_JaffaCakes118.dll

  • Size

    118KB

  • MD5

    3e64576f8a0255a599a042c5188bad84

  • SHA1

    015431caac6c5b7471aa76bd6380aa5bf0ecb41f

  • SHA256

    8225c700412996b75febdf820b0b28d1b1c9a44ef67c958a3bb61b15ce9eae38

  • SHA512

    858f92d2f067043ef2b86b028fd23d8d3b9b5a75669893bb686b9d0891878ee973a208ebe9a39a3a1d60b073dcf2320753a361fe368a45fc2999835e6d01fbdc

  • SSDEEP

    3072:OiritaPJKqYwaubkNUtba7tYACr1/8/rTOCkr4zJrSiazb:VrisxKZwaub/QlOC44hwb

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e64576f8a0255a599a042c5188bad84_JaffaCakes118.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e64576f8a0255a599a042c5188bad84_JaffaCakes118.dll,#1
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4360

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4360-2-0x00000000010E0000-0x00000000010E1000-memory.dmp

      Filesize

      4KB

    • memory/4360-0-0x0000000010000000-0x0000000010024000-memory.dmp

      Filesize

      144KB