Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 16:29

General

  • Target

    f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

  • Size

    385KB

  • MD5

    f631c087cb1fb494ddd5f85fcb33e092

  • SHA1

    d7ad975719521e610efcf167d3d5a17ac5b9d756

  • SHA256

    df766fa95d24b85e49b4658c0bfbf88ebe506b37eaa0a111d35585a5ff46ec8c

  • SHA512

    ea77be4436b34dedd1919763fe923e244f916869110d39c33d75f92112f944415a32bb8b79e7b50c941e1a26d0bdd3feeed5f30620815a0da4de49fd1b5fff44

  • SSDEEP

    6144:8rrWjPOPGPGY5qkWyBJ35UnR6hrP0rE7A+JNY9dWIbgPufn5xt2LKOB:xvPGoP5UnRy0rE74Pbg2P5xJOB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe

    Filesize

    385KB

    MD5

    63c24cf136d5b0b8b613193929572295

    SHA1

    64f9838ca0b6d224fb247383a89b60e997f7a53b

    SHA256

    adda2e66acafe1697b75bb4527d10edf5682c8827a59561a9f8bc1c0f99c9101

    SHA512

    66881e1abe346a0d56e5ec3db4b1c440c6efe49351cf1a357c4013ca4b3eaadc9317988fe2ccbf65810b545e9055d868ddbd78092772ed6dc34ce26027b122ae

  • memory/1444-15-0x0000000001510000-0x0000000001576000-memory.dmp

    Filesize

    408KB

  • memory/1444-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1444-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1444-2-0x0000000000370000-0x00000000003D6000-memory.dmp

    Filesize

    408KB

  • memory/1444-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2800-25-0x0000000000330000-0x000000000038F000-memory.dmp

    Filesize

    380KB

  • memory/2800-16-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2800-17-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB

  • memory/2800-23-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2800-51-0x00000000076B0000-0x00000000076EC000-memory.dmp

    Filesize

    240KB

  • memory/2800-45-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2800-50-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB