Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 16:34

General

  • Target

    427ae18d86d1163216e23551d4ef09cf_JaffaCakes118.dll

  • Size

    555KB

  • MD5

    427ae18d86d1163216e23551d4ef09cf

  • SHA1

    337ffa2db95b8e03a3017702ed84666113512744

  • SHA256

    f92f0a55af5d012e0524929713895e2ffefe0311ab9308e1d0a8aa7b83955fda

  • SHA512

    f40b29f71ad6df76ed166541b5f22aed7b795db08fc1fdc8920ce1f1e6784bbdc42619f61f1cf3d7d2e8710548698ab49f20bc9021d4d504e5c567b3f2ab975d

  • SSDEEP

    6144:EuVZOIIL4jp9QhlcebRY82X7EybcHbNRXXYZuDJOi0YBodw/AQ8/U0vSFqd6KYSp:npIL4kd6f4hHLnQI4X/UO650cG15

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\427ae18d86d1163216e23551d4ef09cf_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\427ae18d86d1163216e23551d4ef09cf_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads