Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

916dafe8a5...18.exe

windows7-x64

1

916dafe8a5...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    128s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 10:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    916dafe8a5c99a9902dcfc599ac8f6d8_JaffaCakes118.exe

  • Size

    164KB

  • MD5

    916dafe8a5c99a9902dcfc599ac8f6d8

  • SHA1

    d16b4b233ab373a8e30079edc8b669604504d08a

  • SHA256

    4cfb6e249088e06015fb9f1f672ecebe2915b587409b6a86e8a41f72adabb537

  • SHA512

    8bd7ffba3e766873be2a0facefa1c9a1d7b7ddaf0fbf084d1916a15c72ed68bcc4ab039e215ad9f63a58182a2b886cee58c86587128f539bc45f5698c089635a

  • SSDEEP

    1536:srCH9vYzq2fz8f51v7b7B8otkFTxU5VXGYf3KFIqR4nWwBMOqYgp6nqKnoRiPz8T:srs9X2LMtnBk5xiHlVqXIqKnoRwz8T

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\916dafe8a5c99a9902dcfc599ac8f6d8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\916dafe8a5c99a9902dcfc599ac8f6d8_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2480-0-0x0000000074611000-0x0000000074612000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2480-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2480-2-0x0000000074610000-0x0000000074BBB000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2480-3-0x0000000074610000-0x0000000074BBB000-memory.dmp

    Filesize

    5.7MB

    Download