Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 17:01

General

  • Target

    fd351fbc25e4d04ea5f1f7c225b1a74e_JaffaCakes118.exe

  • Size

    9KB

  • MD5

    fd351fbc25e4d04ea5f1f7c225b1a74e

  • SHA1

    fb7df69af02ed6894fc5feac0720179356a49335

  • SHA256

    8e2f1bfc30416a68c701f42c717635b091c72d634793c4516602d52f1c999f7c

  • SHA512

    bf5d0eeebb075193f91d00dd80d9c2491d04c0791ab211b26135448c5932a7ae39dfb698e2844a16b68398cc1212f8ef08cbfa323f038e156862dfa721e27fe3

  • SSDEEP

    192:MBksu7m6N7oy1ojeMZZ3r93VnjdwqzD3yGeyTJ:a4xKjeMdFnhwq3CGeyT

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd351fbc25e4d04ea5f1f7c225b1a74e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd351fbc25e4d04ea5f1f7c225b1a74e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2760 -s 904
      2⤵
        PID:2764

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2760-0-0x0000000000F00000-0x0000000000F08000-memory.dmp

      Filesize

      32KB

    • memory/2760-1-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

      Filesize

      9.9MB

    • memory/2760-2-0x000000001A6E0000-0x000000001A760000-memory.dmp

      Filesize

      512KB

    • memory/2760-3-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp

      Filesize

      9.9MB

    • memory/2760-4-0x000000001A6E0000-0x000000001A760000-memory.dmp

      Filesize

      512KB