Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

eaffcb0e67...18.exe

windows7-x64

7

eaffcb0e67...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 11:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe

  • Size

    2.7MB

  • MD5

    eaffcb0e67b51a06cf5544d2805b911f

  • SHA1

    0ad91a4f25a3aefadad8c94b64ec8a3a81f48d5a

  • SHA256

    01adfa786a67d31b4299a380b25f6edfe2963851c4417fa20596de0676c8ab36

  • SHA512

    237935ed99f407d373eb1e21c2154103e61e38d61489c0f00c81f5049b2db706cfbbe690bb9234af5bb47f6124d2dd8092f4fd517f297791c76f69ad7cf9b3fa

  • SSDEEP

    49152:xnbDWbB1smStTEiipeO0duEGBXMZcSHmsOC83PUf0y:d+bB1sdTEi/d+SqSHmsOc

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
    Filesize

    2.7MB

    MD5

    7844a1349cee02c47109aa6608569e4e

    SHA1

    132d4b6e11cdea2c13e62580546e6d7f453fffcc

    SHA256

    6ea1e2ce4546bb176ec53e57169710a2bb5fd7566fc676f730f0d2893a0dd77a

    SHA512

    501648f870e76e5bab8ee6367a4feab10a91b6e086e58bb7d100470790c533b8f849cf60a8202e16788c0ee9b201e9000a28def8a3b35a0b92f5ea40cba1025c

    Download Submit

  • memory/2372-0-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2372-2-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2372-4-0x0000000001A60000-0x0000000001B72000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2372-15-0x0000000003690000-0x0000000003AFA000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2372-17-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2540-18-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2540-19-0x0000000000250000-0x0000000000362000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2540-20-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2540-27-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download