Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2024, 06:08

General

  • Target

    0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe

  • Size

    3.4MB

  • MD5

    0b3a53ec25edfaacd5714245f96aa961

  • SHA1

    333634d7925abf54d204fd30db806643a22b3051

  • SHA256

    527317bebc4b27aa2bfdc72c548312bda57800b0062aa1ace6ad7fc3869afb18

  • SHA512

    a3962ddabb1799509a9d82c218d6109448c16f7499cf12a7cf05749db0e1926e4eb60c26d13bffeb8444bda744fa00a4a2e8e520789874ae6b96505277cd8810

  • SSDEEP

    98304:6Fu2QprAfsDm5Z0WCqXlU+C8AprN40Mr7ugHE:SIrAsWDXlY8o606lHE

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    PID:756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\RCX1547.tmp

    Filesize

    62KB

    MD5

    b126345317624479f78fbf30b3a1fe5a

    SHA1

    655c966bf7bbf96ee49c83062d30b9dba17d693c

    SHA256

    8723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301

    SHA512

    d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d

  • C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

    Filesize

    3.4MB

    MD5

    72799d99868b08f915a526f4acf553c6

    SHA1

    f56ed2056d6ffd0610dc031a56ed481ea1e71c42

    SHA256

    8d7c9b96ecd05eeeec73df3f133d2be978696753f2435bf7e70a54470c6e1360

    SHA512

    47d9bb795e0572fcfd5d0deb41668fd383b20e935704380347129f43c303833592091a2f2b7a84b20f46f4de36cece46039e5305074a3152313b205bc1accd8a

  • memory/756-110-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-111-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-106-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-107-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-108-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-109-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-104-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-105-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-112-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-113-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-114-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-115-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-116-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/756-117-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB