Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 04:00

General

  • Target

    a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe

  • Size

    797KB

  • MD5

    a3c38be04778b03fb05ab5b8f38c79c7

  • SHA1

    70ba4935bb7451f99de3b6f0152afae917980115

  • SHA256

    203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33

  • SHA512

    81f634893859dec19535a881dc142327c76f107cdcb595b7eeda97b8be486c5826cee2618ee09a37c0ba131d9291440416eb5c81274db0233cdd06a28d1dd8d1

  • SSDEEP

    24576:KTydRTZ2UFpSXADfm6S0eS6F9VL4bFKwoJS3kOpUwO5wz:KedRTYsQADfd7cOhKwoJS3kOpUwO5A

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\307.bat
      2⤵
        PID:2596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\307.bat

      Filesize

      175B

      MD5

      89bd7603da71ea29cb76601b6de9e46b

      SHA1

      bb53dfee60b1a9a9d04d9e564659ce4538646c48

      SHA256

      5638f510071b80e773a15db868b411f7d58df304ba7373dae22ca30eb6f49ae7

      SHA512

      3d1085a406074977c26b877de7b6e61f5da84112809e806da2fd005f10b9620aa6153378cbdec3a5ac18d3c22f01784158748d20c5e533305c10f6c4a303c9ef

    • C:\Users\Admin\AppData\Local\Temp\43481.exe

      Filesize

      797KB

      MD5

      a3c38be04778b03fb05ab5b8f38c79c7

      SHA1

      70ba4935bb7451f99de3b6f0152afae917980115

      SHA256

      203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33

      SHA512

      81f634893859dec19535a881dc142327c76f107cdcb595b7eeda97b8be486c5826cee2618ee09a37c0ba131d9291440416eb5c81274db0233cdd06a28d1dd8d1

    • memory/2236-1-0x0000000002AE0000-0x0000000002C25000-memory.dmp

      Filesize

      1.3MB