Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

06be666c75...18.exe

windows7-x64

7

06be666c75...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 03:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06be666c7550a5bbad083e0432de30bc_JaffaCakes118.exe

  • Size

    74KB

  • MD5

    06be666c7550a5bbad083e0432de30bc

  • SHA1

    85673a1b1480844f9143b854430b68312c376b2a

  • SHA256

    8eab7ac16d983be361022a90c8fefc1de23b019a3272718a82fb14609fe9c53a

  • SHA512

    f371c35193800088fac161be93cec0d04a45c2e4207aad6d78d7698fca572edb03763e1bc056fea87b36dec6b5c3dc3c43d31216ad13fce125169e854e741722

  • SSDEEP

    1536:GoLDYsacy7mHMowHjXJF5BviSlqSyPhPmpJwPKbiGcah:GoPyys5jXJF5BaJzPqeyWe

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 15 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\06be666c7550a5bbad083e0432de30bc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\06be666c7550a5bbad083e0432de30bc_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nst1D43.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst1D43.tmp\inetc.dll
    Filesize

    21KB

    MD5

    d7a3fa6a6c738b4a3c40d5602af20b08

    SHA1

    34fc75d97f640609cb6cadb001da2cb2c0b3538a

    SHA256

    67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e

    SHA512

    75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst1D43.tmp\nsWeb.dll
    Filesize

    8KB

    MD5

    84bcf3c71e70d5a6e9dc07d70466bdc3

    SHA1

    31603a1afc2d767a3392d363ff61533beaa25359

    SHA256

    7d4da7469d00e98f863b78caece3f2b753e26d7ce0ca9916c0802c35d7d22bcf

    SHA512

    61aefa3c22d2f66053f568a4cc3a5fc1cf9deb514213b550e5182edcecd88fadf0cb78e7a593e6d4b7261ed1238e7693f1d38170c84a68baf4943c3b9584d48e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst1D43.tmp\registry.dll
    Filesize

    24KB

    MD5

    2b7007ed0262ca02ef69d8990815cbeb

    SHA1

    2eabe4f755213666dbbbde024a5235ddde02b47f

    SHA256

    0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

    SHA512

    aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

    Download Submit