Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe
-
Size
797KB
-
MD5
a3c38be04778b03fb05ab5b8f38c79c7
-
SHA1
70ba4935bb7451f99de3b6f0152afae917980115
-
SHA256
203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33
-
SHA512
81f634893859dec19535a881dc142327c76f107cdcb595b7eeda97b8be486c5826cee2618ee09a37c0ba131d9291440416eb5c81274db0233cdd06a28d1dd8d1
-
SSDEEP
24576:KTydRTZ2UFpSXADfm6S0eS6F9VL4bFKwoJS3kOpUwO5wz:KedRTYsQADfd7cOhKwoJS3kOpUwO5A
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2596 2236 a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe 28 PID 2236 wrote to memory of 2596 2236 a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe 28 PID 2236 wrote to memory of 2596 2236 a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe 28 PID 2236 wrote to memory of 2596 2236 a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3c38be04778b03fb05ab5b8f38c79c7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\307.bat2⤵PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175B
MD589bd7603da71ea29cb76601b6de9e46b
SHA1bb53dfee60b1a9a9d04d9e564659ce4538646c48
SHA2565638f510071b80e773a15db868b411f7d58df304ba7373dae22ca30eb6f49ae7
SHA5123d1085a406074977c26b877de7b6e61f5da84112809e806da2fd005f10b9620aa6153378cbdec3a5ac18d3c22f01784158748d20c5e533305c10f6c4a303c9ef
-
Filesize
797KB
MD5a3c38be04778b03fb05ab5b8f38c79c7
SHA170ba4935bb7451f99de3b6f0152afae917980115
SHA256203b49b087d7da31170b87119f0218887641f2a8ef48b98c6400b2d5e10aee33
SHA51281f634893859dec19535a881dc142327c76f107cdcb595b7eeda97b8be486c5826cee2618ee09a37c0ba131d9291440416eb5c81274db0233cdd06a28d1dd8d1