Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 09:41

General

  • Target

    dfee80ca5e3d08e5b7d8ffa17f3ec5b8_JaffaCakes118.dll

  • Size

    82KB

  • MD5

    dfee80ca5e3d08e5b7d8ffa17f3ec5b8

  • SHA1

    dca9fae89160697a8e8b6c9daae4409a496adca5

  • SHA256

    c1327c1e2d8b87e9883b5345f7edccfd464d002eadedd82df1e45f0358f73679

  • SHA512

    cf054d6eead99ba9a29119c414106925fb72fae70d8f4d141d97dc4d7b97de595fd0e1ba0556e1f0d65b9705cfd11712e15aca122915e5c3a451e893e71ead21

  • SSDEEP

    1536:PWRw/W0HAK4dBUgYG4Req5StZjcEsS0GkBz9R0sVgCuD/eiG+y07:mIAtZtUigEwlz910Wz8

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfee80ca5e3d08e5b7d8ffa17f3ec5b8_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfee80ca5e3d08e5b7d8ffa17f3ec5b8_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads