Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 21:31

General

  • Target

    81cc16ea7143e2e26d8aa040765fe083_JaffaCakes118.dll

  • Size

    121KB

  • MD5

    81cc16ea7143e2e26d8aa040765fe083

  • SHA1

    493445df9f382d24db9ca1ea0780967d63830b49

  • SHA256

    009f2f72eb398efba8568515b191e56cfa13f4b93760f2215cfe706e85423575

  • SHA512

    4346e6d1d96eac3c13fcb0356905037b5e5517434f14d760b78ca7dfe82565e666bbe0e7d8a1b57141ad34b805595cc340a4c63c7d76b6d67f12d364f4b91841

  • SSDEEP

    3072:CM6aDMCerVgL0LDhZonurACDU5bY7R71/Er1Ob9dH22C67HF+7SaIeVxJMdCJZAH:CMjQZO4NKn6U5wx1cr0b9dW2FHF+7v7g

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\81cc16ea7143e2e26d8aa040765fe083_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\81cc16ea7143e2e26d8aa040765fe083_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2512-0-0x0000000002040000-0x0000000002148000-memory.dmp

    Filesize

    1.0MB