Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/09/2024, 20:17

General

  • Target

    e9e734e0c5d552f4dc2ac03d111aa0c7_JaffaCakes118.dll

  • Size

    318KB

  • MD5

    e9e734e0c5d552f4dc2ac03d111aa0c7

  • SHA1

    b3725c1b1ce0cf18b528b3ff1c10f094d26ff4e4

  • SHA256

    70691bd4fe48390c5c29eb2266f1e2cc4198c8300f206a9bac96bd5f8b788e20

  • SHA512

    2012da6b27bbc434908f76a3ee18e1d74bfcc4166a1277fb92510de1b1b77a0002f6b938e0a2330232aee59f08eb6ac9b7aa0c71023437e9149f4003b271dd23

  • SSDEEP

    6144:mvDDHy5z2wg9btsWXxntETMF4efN3VnlfxG4x+7UX9lwdpPbkg8TF+8x:GDS5zng5+8n8vMVlZF+7UTUTkg8R+8x

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9e734e0c5d552f4dc2ac03d111aa0c7_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9e734e0c5d552f4dc2ac03d111aa0c7_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads