Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

f1dc579aab...18.exe

windows7-x64

7

f1dc579aab...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    f1dc579aab26e21eceadec0a392709ec

  • SHA1

    59661cccf1c2d8ef5aadcd81e7f316319ee4cd4b

  • SHA256

    0639974033c94031b6fdc04b1d44a3b37af0b8d03fe98e3fb13f1fb6100d9871

  • SHA512

    d10e4a1052b1c813702592e80efedfcd3100952091394c022e81974594e1bfd4f93a9270590822e5399ca7c592abc1e4bfa0ab67990e85b4216003362f470810

  • SSDEEP

    24576:Ex3a3t014+bIiavmtbzncQxFSWjww7BRJz5qBbvDIMc0nix5gk+GsrbeTagxvG:ER1wiav+znc+FSWjwqBRd5qBbY0q+1H

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
    Filesize

    1.3MB

    MD5

    4df62e05aeaaebda7a5ab421165d2080

    SHA1

    da207647510d7ad430eb726f97e4f83e3696581a

    SHA256

    5aca98ce5169448c75a079df2d843764782e528f67d0d94f70f14e584aa70850

    SHA512

    c3f251bc8beaff49a3d563c3f183af7a619a2993ac0003d83a51a374272a87b44d6f444b5392271e622f42707b02a463b9ed8a37787eb31c9c157c26128ce0ea

    Download Submit

  • memory/2168-1-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2168-0-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2168-3-0x0000000000290000-0x00000000003A2000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2168-24-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2248-15-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/2248-16-0x0000000001A60000-0x0000000001B72000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2248-17-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2248-25-0x0000000000400000-0x000000000086A000-memory.dmp

    Filesize

    4.4MB

    Download