Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 01:38

General

  • Target

    03eae5f33b1138477d3395c2277c547c_JaffaCakes118.dll

  • Size

    650KB

  • MD5

    03eae5f33b1138477d3395c2277c547c

  • SHA1

    3b895c470028555b973f9c2f0b6ebb30367246a5

  • SHA256

    7a663f22fad40d573f2ebab2781ec317a165e998a5851b43e1c1b41cf0ca8544

  • SHA512

    e10091140b62764f7c727c644e42558a9a3397344f0a239d9ff54800070611350692f9de3a5ec4afcd86df1c9d7a0dd8e4eab783c7d107286634a33c1bb5135c

  • SSDEEP

    12288:ZGEWq64tvJ3gVGuotIbD+HtfzTqlB/vj9k+6UktMaF5RxR/heJ:ZGjq64HgVk6qtf/q/L9k+klq

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\03eae5f33b1138477d3395c2277c547c_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\03eae5f33b1138477d3395c2277c547c_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads