Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 00:50

General

  • Target

    621db372c10e14390beb482c761a5d8d_JaffaCakes118.dll

  • Size

    167KB

  • MD5

    621db372c10e14390beb482c761a5d8d

  • SHA1

    ebdf50b103b78d35044e6225151c197ec4eb52dd

  • SHA256

    9e63ce16708454a256c7d378f2065e2ee004713400cd98f43be1eab8d3892217

  • SHA512

    526b5444c1d8ef4367830f5b878dead4ccd05e000d71072c73db30feb91eb5e926efb299439ad371d3ecb0b0e68e777d0e02b49652f3fe6f5198633e00a567c8

  • SSDEEP

    3072:BNNVHv/XWb8F8tBr5LUJ5Vj6okQBux8fTJWIkYc+qp348X2Du/pDNOVsHMP:BNfHv/XWbRr5QJj6ovIx89WT+38mqDNJ

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\621db372c10e14390beb482c761a5d8d_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\621db372c10e14390beb482c761a5d8d_JaffaCakes118.dll,#1
      2⤵
        PID:4844

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4844-0-0x0000000067A10000-0x0000000067A80000-memory.dmp

      Filesize

      448KB

    • memory/4844-1-0x0000000002110000-0x0000000002111000-memory.dmp

      Filesize

      4KB