Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 09:51

General

  • Target

    da1729df8a3485cc5e548ac21cd9209e_JaffaCakes118.dll

  • Size

    250KB

  • MD5

    da1729df8a3485cc5e548ac21cd9209e

  • SHA1

    28e7e232e8dde054cb3b8cf62ded3f293afbf38a

  • SHA256

    10d859c07e2b1572b46c52eda17f2e61f9754e8e64b361e4606be6df5e542b22

  • SHA512

    0edf1e9fe53ade63bcb1c43f396b50de31e155cebd9417398cb8db3db937ce74c8478e1c1c0e29cf6ff859ff8fcbbb1c978322bc8d3613f5ec30bbe10dc6ae23

  • SSDEEP

    6144:zr72S8iPKc/27KjT/ZwnNBTVOTBBUy3wqqwkMs5:H72+Kc/XjT6jGAqqn

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 48 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da1729df8a3485cc5e548ac21cd9209e_JaffaCakes118.dll
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads