Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24/06/2024, 09:35

General

  • Target

    07bd0e8cd65f3671801780525b763f21_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    07bd0e8cd65f3671801780525b763f21

  • SHA1

    eff6e18dbe9256e249de82c244e2d88e03dcf525

  • SHA256

    18872a45bdb893140f8a91e6a17999227eed1f97e422f6b68e14ad019af61cb9

  • SHA512

    faee415aabb24a1b0b36d8bf23a4745d0ba2f355f4dd36f3fcf07dd8d3482715a865e88d008e7555915f2e320d7e8568bd9943fe4b8150e7838350e303eae8e8

  • SSDEEP

    12288:U4qJPu3O2Obz06e682yjLVkY7Hjs/K5CFTkzcZPqwJMMnGWRGZXtnY++aBMVLnfo:U4qk3/T68vaaZXeM+VZF5QZ/N4l6HQC

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07bd0e8cd65f3671801780525b763f21_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\07bd0e8cd65f3671801780525b763f21_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
        PID:2004
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        dw20.exe -x -s 856
        2⤵
          PID:2844

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2844-3-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

        Filesize

        4KB

      • memory/3016-0-0x000007FEF5A5E000-0x000007FEF5A5F000-memory.dmp

        Filesize

        4KB

      • memory/3016-1-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

        Filesize

        9.6MB

      • memory/3016-2-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

        Filesize

        9.6MB

      • memory/3016-4-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

        Filesize

        9.6MB

      • memory/3016-5-0x000007FEF5A5E000-0x000007FEF5A5F000-memory.dmp

        Filesize

        4KB