Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 12:32

General

  • Target

    0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll

  • Size

    27KB

  • MD5

    0aae18d03bccc07e326165fe106faf94

  • SHA1

    503a4cbb0b0829b9ab25c331b81d85fd2b0e383e

  • SHA256

    f321707f4b46bcd16dd5e774cc80a064137d315eee07909b5f8096d451d36e68

  • SHA512

    c2402338a7aa6921507cdc725c931faba387f1b40c03f5d91dd067cbbcfe5dc2073383f7d61d2a6b052f8168b0e4d623b4dd9cc32ed730c2b5d6565893dd532d

  • SSDEEP

    768:nStC5ER3RwrEhrvbO4r0DLVXQThRTlXA4A4i4UOC8:nSLRIERzOBVuTo/8

Score
5/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0aae18d03bccc07e326165fe106faf94_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2332-0-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB