Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 23:44
General
-
Target
b5844ec8b0d13aa0b3757cab5f8a4234_JaffaCakes118.dll
-
Size
992KB
-
MD5
b5844ec8b0d13aa0b3757cab5f8a4234
-
SHA1
b7e2c872277ccf1d5a3de7dbd822a4cfc9afa70c
-
SHA256
59bc8120f510c6e96a51bfc3af6ef71edf660097f711345746a4e3b17578e4c9
-
SHA512
fb7694c4f179d79746c7f23937b74b459e4c5bf923f22ee2f024d07d2676631321b8509ee12c2a2c02be3dcb216dd051b56b67c51e4f13e5f340615ce9cfb126
-
SSDEEP
24576:kFWv1KaJDrL+EeaWJC7S/akvxJlxVpcTHSvtz3rdXVSf8K:GWvMaFDeaQC7S/akrl7W+vxmUK
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 36 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5844ec8b0d13aa0b3757cab5f8a4234_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5844ec8b0d13aa0b3757cab5f8a4234_JaffaCakes118.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB