Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 18:03

General

  • Target

    08790680aeeb19006446205ed9c41427_JaffaCakes118.exe

  • Size

    154KB

  • MD5

    08790680aeeb19006446205ed9c41427

  • SHA1

    abc18dfcdc28f97df3f4c9083d054a162c23bc27

  • SHA256

    f5944eed723550d48fda0da374f2b1da7d45bde536f6f3d7b07af3643aba8498

  • SHA512

    5b0ea7b73bb35d495bb0d947e6acd4d6276b3d259e540fface9d5e2dcbe3146af283c654f5b79dab75cf841aa1712d8d5677e2d2d903feac3c67e0e73041e363

  • SSDEEP

    3072:YE06GPlGqWj9IBdmnyt9YEqFHb5RwK/3Yq63+sYHP:YE0/49IrHc5Rw+g

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08790680aeeb19006446205ed9c41427_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08790680aeeb19006446205ed9c41427_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\MSWINSCK.OCX

    Filesize

    106KB

    MD5

    979348b1e637977fb5d42ceb98f4fbd2

    SHA1

    42b7e2bcc6ee0c12e1bdf3448fd940bf081a97d0

    SHA256

    26d0f1c250622a6be579907e774e7b0f930180b810e72bc2e284d2c509e1e0c3

    SHA512

    55f3fc0331f639ed9e463cd6aee3b21f63c75545121aa1579566ceaf15ba1e7c342f125300a80d5e113446aae37c22d8e8952e4b650edc4e2c8662170a421307