Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 15:10

General

  • Target

    064d4b0376a5ca6dfd77a4fa59a8d444_JaffaCakes118.dll

  • Size

    374KB

  • MD5

    064d4b0376a5ca6dfd77a4fa59a8d444

  • SHA1

    fc949c9c34ff540d1611015751dff51a9a487eb0

  • SHA256

    fa6539ed76b58d1885073245ff4cc9b28abf184cd4fc96dc05fb44fc85c4e4c6

  • SHA512

    05685e32ce27cfe6607f1cc43b21846b73a44997b1009644ac8d58dc9eb5d228631f8e2c9293712b5f721a39f3bb5abe13c4437321d4034a311c3bd4413b3275

  • SSDEEP

    6144:0qlDN4KvAw8uA6N4s+Uf7sOSHZPxCW3e0dZfFgCZTdsmnElI+px83HsLS+0A1E:1/X8xM4sjwOS5PX1dTdxGmnOYHs2jAy

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\064d4b0376a5ca6dfd77a4fa59a8d444_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\064d4b0376a5ca6dfd77a4fa59a8d444_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 292
        3⤵
        • Program crash
        PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2204-0-0x00000000006E0000-0x0000000000755000-memory.dmp

    Filesize

    468KB

  • memory/2204-2-0x00000000006E0000-0x0000000000755000-memory.dmp

    Filesize

    468KB

  • memory/2204-1-0x00000000006E0000-0x0000000000755000-memory.dmp

    Filesize

    468KB

  • memory/2204-3-0x000000000071F000-0x0000000000720000-memory.dmp

    Filesize

    4KB

  • memory/2204-4-0x00000000006E0000-0x0000000000755000-memory.dmp

    Filesize

    468KB

  • memory/2204-5-0x00000000006E0000-0x0000000000755000-memory.dmp

    Filesize

    468KB