Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 18:03

General

  • Target

    ac05f3e3c0774eac69ed06a6d2cbb543_JaffaCakes118.dll

  • Size

    436KB

  • MD5

    ac05f3e3c0774eac69ed06a6d2cbb543

  • SHA1

    48f8b34ec60a0469c03f4ced8250720cde961383

  • SHA256

    cb6ffd40086f791f484e4e35e2a3fbf0fdf112cd6f9f749478e831ac8e8e1106

  • SHA512

    0c20771add113db39b4b753e7cfd6458cbf0dd7b81cfb0f73a9a0d471acd9dd6c76668c0b8a478c273798466869f8ca4ef0154e6f29f2df969540ee69f7682f3

  • SSDEEP

    12288:6Kc3Y0IDPO3RZIqOVCUlcOQ+tuYw7dmvxdtLMkOa:zcI0I2ZIqzcu+vw7QxLv

Score
7/10

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac05f3e3c0774eac69ed06a6d2cbb543_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac05f3e3c0774eac69ed06a6d2cbb543_JaffaCakes118.dll,#1
      2⤵
      • Identifies Wine through registry keys
      • System Location Discovery: System Language Discovery
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3040-0-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB

  • memory/3040-1-0x0000000000E50000-0x0000000000EED000-memory.dmp

    Filesize

    628KB

  • memory/3040-2-0x0000000002530000-0x00000000026CE000-memory.dmp

    Filesize

    1.6MB

  • memory/3040-3-0x0000000010000000-0x0000000010121000-memory.dmp

    Filesize

    1.1MB