Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

08939f85e7...18.exe

windows7-x64

5

08939f85e7...18.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/06/2024, 12:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08939f85e70240922624a832ec35c34b_JaffaCakes118.exe

  • Size

    45KB

  • MD5

    08939f85e70240922624a832ec35c34b

  • SHA1

    a0103385fa86e976bef3f31c6b32207b2d5c76ff

  • SHA256

    86c60c71008ce353a6b48dbafb5d1ecf7b291f2bfceabcff6f538c17d1b30f7d

  • SHA512

    b4c5ca6b2f4589b3374b08940b7e79735d39a85013c152bdd0cd4fb5e1b867fad0b3b7110410914d690a0fc3660b71c66e89ebb0b5ffcfad4acb12ee6fc739ad

  • SSDEEP

    768:4V8MQ2OD7Tt077k2zASbRQpjDAsUvXw+7uqsoWCROV2IJw54XnTOOz4wTEyi:z72OD7Ttqku63AsarmJVlJWa6OFE

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\08939f85e70240922624a832ec35c34b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\08939f85e70240922624a832ec35c34b_JaffaCakes118.exe"
        2⤵
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1260-2-0x0000000002B60000-0x0000000002B68000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2392-0-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

      Download

    • memory/2392-3-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

      Download