Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 12:34

General

  • Target

    e030fba344c3691de05475d62ffa7b9a_JaffaCakes118.dll

  • Size

    19KB

  • MD5

    e030fba344c3691de05475d62ffa7b9a

  • SHA1

    61cbeea89c475266ad3895b7cff9e9ca36f8372f

  • SHA256

    735e2586de24c6336ac38b24804794ca664975c7cd2b3bad41a9ae3c6f359d8c

  • SHA512

    85bd7326857e959fd0df6c05b7a9531aa8220c0e28ee83c5158f8df1cb088a3165e986f0b0f4e8e037c015c8a9a3251cdbb92b710e3de15b499590f94528082a

  • SSDEEP

    384:OSGswXCS8wVOx7CqCl0+0XplODM4uxSyWHuqaTln8:OMUU7C+pXPODM58OqaS

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e030fba344c3691de05475d62ffa7b9a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e030fba344c3691de05475d62ffa7b9a_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads