Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 02:26

General

  • Target

    54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll

  • Size

    752KB

  • MD5

    54f976278d9dc06fab5251a87d10f195

  • SHA1

    5f879fc1ada50704d8a58f2613295e48cffea5ec

  • SHA256

    aafa481b41f2b8c1e617accf28b7fd5d5a5dd1fc86b95d53cec40582e84f4d3e

  • SHA512

    801ea748e0da0d04257a7dc7cb647e4f61ccdb08da8d12d08d0166da4baec1105f4634ec7f4f67d10bd01a0c9c2072dbbee8f2495f6ab2bac7ea449671a5d8dd

  • SSDEEP

    6144:mVGryRrIMtoTf4uJiQDrJGHcFl6G6wlRhwjSNL4SMcvTp/47EnfJoSCUyYz7U/C:mgryRrI/Tfw2JecFl6GvRGC1eEx4K

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\54f976278d9dc06fab5251a87d10f195_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads