Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 07:50

General

  • Target

    04b59991e1ac5b0b5fb1273f8d90ce75_JaffaCakes118.exe

  • Size

    450KB

  • MD5

    04b59991e1ac5b0b5fb1273f8d90ce75

  • SHA1

    3670fdad869d5ab59d138aabc56f789fbe8f299e

  • SHA256

    c5641118624861ba44060cde9e621b261275e1fbd743592bdd1994c69ef7f37f

  • SHA512

    fa7789c498a621111b93c2d4a95f98e1736257ab218735b854de371dd3add14538b5504c94194ba571af97777c7fff7ea83cde47ee7ed94583de8818bdae615b

  • SSDEEP

    6144:gs833CnotE7RN8Jqeh5sIgD+U/MsqJwu7Bn6nVIdluqCTX2J/wJ9SqSil:mLtE7RaAeUp+ULMniCluqA2iJ8Vil

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04b59991e1ac5b0b5fb1273f8d90ce75_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04b59991e1ac5b0b5fb1273f8d90ce75_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\sys32\$$FREE$$ .exe

    Filesize

    492KB

    MD5

    d9ea8c0df61344962e4a531c650445f7

    SHA1

    b9c6308f847e355821c0d194c32b0270beef398a

    SHA256

    75114e39d629cf04fffd830f3ee8f2e60646dc296ba661385ded3a6c7e846d63

    SHA512

    181dadaaddf1c8ccde02be904a422e7bd3d211aaf5affe119f6b792e4f539400943a07e7863ca5cd709b10e467903ad1fb780a6ec963e74a4776c1c5de56d508

  • memory/3028-107-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-147-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-28-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-33-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/3028-48-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-71-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-11-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-88-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-124-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-0-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/3028-166-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-183-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-202-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-223-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-242-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/3028-261-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB