Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

d29be6e2c0...18.exe

windows7-x64

7

d29be6e2c0...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 11:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d29be6e2c008ada25460b0dddb64fee1_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    d29be6e2c008ada25460b0dddb64fee1

  • SHA1

    26ec752f67fb01dadce8415065730ed98258e5a0

  • SHA256

    295a3b6dd2930ef076a0d8253ca01f72821d301a999a4c7e959d2e17612ea380

  • SHA512

    fbd7d71ab060b7fb106ef309486aeeaf2181815a6de87093462d86fe43d7695522a870d84f301a0758b16d5c7fbf1e8cdf371bc126487d8e2a5d5ce6a65ac204

  • SSDEEP

    49152:Qoa1taC070d9lxNr8qqu8BQkKvqhwW5mNk:Qoa1taC0KbaAC5Gk

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d29be6e2c008ada25460b0dddb64fee1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d29be6e2c008ada25460b0dddb64fee1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\1A73.tmp
      "C:\Users\Admin\AppData\Local\Temp\1A73.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d29be6e2c008ada25460b0dddb64fee1_JaffaCakes118.exe A1E9BED0B7B2567A913D59994BC22A193BB68ABDF3D3E3F8AFEAA70CD9F9C4DB35F8791EC88C75B59A8C1788EBA12320A7EFB9A807374E84AC91DC3ECB2A3D38
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1A73.tmp
    Filesize

    1.9MB

    MD5

    0f7201fc4e81ea70948f62a92429d6d7

    SHA1

    a6c2944dd97ffabb1c938b94180da06f064af3f3

    SHA256

    2a1a3dd3994b46f7e4b1b0e8f06ba764cdad0285d39a1cbcdf7854a5e89e8ce3

    SHA512

    f4fce5400a65ee860d221a6bf9d35df612f633c399193e73ec15daa5f7b15ba793eec8b514474156a11397be36b0169086bc08de53c3f961c01264283713d8d7

    Download Submit

  • memory/2484-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2848-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download