Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 22:18

General

  • Target

    6031ea55de61401730b308558e20f6d9_JaffaCakes118.dll

  • Size

    142KB

  • MD5

    6031ea55de61401730b308558e20f6d9

  • SHA1

    e48fd706399c638a704ae0d2848b8201dd6eedfb

  • SHA256

    61c0aa1ffeadac44e6c5a203cf3f4b80c4ff40b01b5bd8206eb0f4da0ea32a42

  • SHA512

    08aa8652d30e785c42d12cff5f80e6195c40113c4cf14b71af712a54a9e586afd44a3fe8c1a600475ded41a1cac1ef1bd60df87f8237cee8182b79147be49628

  • SSDEEP

    1536:3A2D7/ZT3/Nlq9ireDmy2U4exSVhqZ2dCcN2Zy1+SYN6dB5m7mZCJjUa:N7B32Vk7hm28jyxYN6dB53IJ5

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies registry class 60 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6031ea55de61401730b308558e20f6d9_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\6031ea55de61401730b308558e20f6d9_JaffaCakes118.dll
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:4804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads