Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

0fc9c26fbb...18.exe

windows7-x64

6

0fc9c26fbb...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 22:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    0fc9c26fbb31da1172fae1b669414d02

  • SHA1

    3e7f3d658ec3e9d64159d973db252092f0349bd2

  • SHA256

    1c64bc65afb39f783ecc9dc76124aa306e5c690e0e955268b7c456551e2b4bc8

  • SHA512

    bceaa1fd75eef3390478b526dd49e2db7545d896b910060921251ac9df1030a1e9173f6c0c6a3681ae6b5a820a547c895f3ef35fe4842dc7fd0f3f2ffba52a14

  • SSDEEP

    3072:KsoKKS5ZaWAcv+9e792oC+JsrznsomYVAPcqZq+A/o2uFHoUupCb:poK1aYj79bYntoEqZxAEus

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1484-0-0x0000000000220000-0x0000000000243000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1484-2-0x0000000000401000-0x000000000040F000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1484-1-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1484-3-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/1484-4-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/1484-5-0x0000000000220000-0x0000000000243000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1484-6-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1484-7-0x0000000000401000-0x000000000040F000-memory.dmp

    Filesize

    56KB

    Download