Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 04:50

General

  • Target

    02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe

  • Size

    42KB

  • MD5

    02efe4c0b1e4e264b9ce097bb41f8e21

  • SHA1

    471fb4bf07d3be53d7c440ccdc42e9d4a586dc5f

  • SHA256

    7089e7b7ded8edf01674085e4f891cc73dc4c104b1dbc0f643a3d35971f1dc2e

  • SHA512

    32da8b24f2a0d86081740238a3e17030643e21ecac98b0bab226e97649c06005a9dfbe52ccec7373d4f63bd3de9b59dfdf8fa923fc8ef179f5b4838579d78511

  • SSDEEP

    768:X/VrQUqTQEHGWJrt+E8ASirfEyjS9V0q8ksYEpoKhHXQ4twMJJvG9qzY1xQV:X5PeQUGWlIE8+cmSEq8pYEFhHFXsxu

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\02efe4c0b1e4e264b9ce097bb41f8e21_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a..bat

    Filesize

    238B

    MD5

    ace6bcc7870496ac839d9a17c7a83a88

    SHA1

    11c4270a6f24cd5564b3e5b671fae16e26a63a71

    SHA256

    ded8c50a149ad4a0bc1caa40642f6dba619b2781860fe789babbeb0e434a08b5

    SHA512

    f4b8b9d1a143906dee32d8c291be9b9f77ebe90a3802718c698a3799cf95f325f13e93cbdc6bc073d824c58c61ec02c7e6315e2bc73a8277747ea8676a69441e

  • memory/1800-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1800-1-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/1800-3-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB