Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/07/2024, 09:36

General

  • Target

    77b19407e43ce9a3c895ba6efd668181_JaffaCakes118.dll

  • Size

    318KB

  • MD5

    77b19407e43ce9a3c895ba6efd668181

  • SHA1

    f19c751a8fc12a9cf52049e92e52d4dd00dde2a0

  • SHA256

    e3c7d16fb282c3698075ab762de86a21aca77eeebd598d4f6d3001967823cf1c

  • SHA512

    032d8657fc3b8e4405fe23c8e268ab0f7ddabdaf7ee958c4962ab2b876eeddde0c4a312643f8af6d1a41558430e2993f2c50ff870b69988ddbc79b0b73be8445

  • SSDEEP

    6144:mvDDHy5z2wg9btsWXxntETMF4efN3VnlfxG4x+7UX9lwdpPbkg8TF+87:GDS5zng5+8n8vMVlZF+7UTUTkg8R+87

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\77b19407e43ce9a3c895ba6efd668181_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\77b19407e43ce9a3c895ba6efd668181_JaffaCakes118.dll,#1
      2⤵
      • Boot or Logon Autostart Execution: Authentication Package
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2056-0-0x0000000010000000-0x000000001009D000-memory.dmp

    Filesize

    628KB

  • memory/2056-1-0x0000000010000000-0x000000001009D000-memory.dmp

    Filesize

    628KB