Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 21:13

General

  • Target

    ec00d74fa79fa866768a6feb5d4aacef_JaffaCakes118.exe

  • Size

    341KB

  • MD5

    ec00d74fa79fa866768a6feb5d4aacef

  • SHA1

    06615c8319ac128d7179443b33585a2cb0f24d22

  • SHA256

    051cfc331e51274833fa38d0b830316110f6baeec6d44aca2400a06f554c77ee

  • SHA512

    83338a81d5ff602ac24f3fb1cc6fe8515b59b9838b75c28338f76f3943978080fdabcd3e624ba676afc527f3c85ff6356a167cfd5bfa234d0806b92c52561450

  • SSDEEP

    6144:mcPkfVE1BvZ92m5qOl2e0sTaqXSEMLefAfZ3Ht:1sVEfh9z0FsVXaLe0Z3Ht

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec00d74fa79fa866768a6feb5d4aacef_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ec00d74fa79fa866768a6feb5d4aacef_JaffaCakes118.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1972-1-0x0000000000110000-0x0000000000139000-memory.dmp

    Filesize

    164KB

  • memory/1972-3-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/1972-4-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/1972-2-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/1972-0-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1972-9-0x0000000000110000-0x0000000000139000-memory.dmp

    Filesize

    164KB

  • memory/1972-5-0x0000000000160000-0x000000000018F000-memory.dmp

    Filesize

    188KB

  • memory/1972-14-0x00000000001D0000-0x00000000001F7000-memory.dmp

    Filesize

    156KB

  • memory/1972-19-0x0000000000110000-0x0000000000139000-memory.dmp

    Filesize

    164KB

  • memory/1972-23-0x0000000000110000-0x0000000000139000-memory.dmp

    Filesize

    164KB

  • memory/1972-25-0x0000000000110000-0x0000000000139000-memory.dmp

    Filesize

    164KB