Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2024, 13:33

General

  • Target

    60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll

  • Size

    40KB

  • MD5

    60ab94cdcb872632ce20f0a60f2d96f6

  • SHA1

    034a5962ac65e35ca4090bff7a47b3a80fd1cccd

  • SHA256

    5ef353e439dbf47b6cea65fb54e97c5bae49b1e8800bb3dae365270520d215a3

  • SHA512

    8990fefd561baa47bf1dc63a916e0222ac4c7bc85515c0397540ef406e3dac05cf4473f832f012cefcb48a3db719ec811ed0493f73b93be92ca82982fe15d3cb

  • SSDEEP

    768:jBsdD5cLCLHoQFmFMK2XUymw2nrpkavDWgLa16XW/h:xuDo6M5Zym8QzLabJ

Score
1/10

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\SysWOW64\Rundll32.exe
        C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\60ab94cdcb872632ce20f0a60f2d96f6_JaffaCakes118.dll,DllUnregisterServer
        3⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads