Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 09:57

General

  • Target

    959be91f5aacada14927db4b08509cf9_JaffaCakes118.dll

  • Size

    36KB

  • MD5

    959be91f5aacada14927db4b08509cf9

  • SHA1

    d1a16750b8459f414676c6172633129e7a146830

  • SHA256

    4514d8f7f15f0acef2cbedb0c0187c84e9c6df8e2e1a97915fa226bd3d24f67b

  • SHA512

    fc26c39c6d7e26ae2acdc440d2fa96823bbed45f4e3b4ec3b2935194c116a3b3015ea3d5b63bc2545ab2f6569cb0f27a2b5c5e89be3cffa7f6f5c7c4ef386c00

  • SSDEEP

    384:b30Pba3dp3de3ea+PK3oSvNS3+o8WI4Vte/Qpct5t9999+uCo:b5xe3eafPvNSD8W9w/Qat5Yu

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\959be91f5aacada14927db4b08509cf9_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\959be91f5aacada14927db4b08509cf9_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads