Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 05:31

General

  • Target

    f54bbcf8d9b86e03e9c50354d39ec243_JaffaCakes118.dll

  • Size

    72KB

  • MD5

    f54bbcf8d9b86e03e9c50354d39ec243

  • SHA1

    c499ed7da413c097251188b4b94e53a4bee8d8e5

  • SHA256

    40506ea2e1f1eb7d41b88d4fb10f5fd27dc9ffd4862c4852ce0ebff12b13d0c5

  • SHA512

    a6137c47216d4d99328f2429773838da396bad0caa017fd767f7daa28dd79df31c1cac9ccd7ed6e8d044b0c0487fcbde6c1ebe8f5d0c9048aca6cdc7089f430f

  • SSDEEP

    1536:+RiqWKKt46Rern469h33CLoMmxewKodKTuw9jVtV1ON:+1WRy8er4m3S8MsewKom3jVL

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f54bbcf8d9b86e03e9c50354d39ec243_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f54bbcf8d9b86e03e9c50354d39ec243_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/912-0-0x0000000010000000-0x0000000010017000-memory.dmp

    Filesize

    92KB