Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 22:38 UTC

General

  • Target

    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    0fc9c26fbb31da1172fae1b669414d02

  • SHA1

    3e7f3d658ec3e9d64159d973db252092f0349bd2

  • SHA256

    1c64bc65afb39f783ecc9dc76124aa306e5c690e0e955268b7c456551e2b4bc8

  • SHA512

    bceaa1fd75eef3390478b526dd49e2db7545d896b910060921251ac9df1030a1e9173f6c0c6a3681ae6b5a820a547c895f3ef35fe4842dc7fd0f3f2ffba52a14

  • SSDEEP

    3072:KsoKKS5ZaWAcv+9e792oC+JsrznsomYVAPcqZq+A/o2uFHoUupCb:poK1aYj79bYntoEqZxAEus

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1484

Network

  • flag-us
    DNS
    boltoflexaria.in
    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    boltoflexaria.in
    IN A
  • flag-us
    DNS
    boltoflexaria.in
    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    boltoflexaria.in
    IN A
  • flag-us
    DNS
    boltoflexaria.in
    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    boltoflexaria.in
    IN A
  • flag-us
    DNS
    boltoflexaria.in
    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    boltoflexaria.in
    IN A
  • flag-us
    DNS
    boltoflexaria.in
    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    boltoflexaria.in
    IN A
No results found
  • 8.8.8.8:53
    boltoflexaria.in
    dns
    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    310 B
    5

    DNS Request

    boltoflexaria.in

    DNS Request

    boltoflexaria.in

    DNS Request

    boltoflexaria.in

    DNS Request

    boltoflexaria.in

    DNS Request

    boltoflexaria.in

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1484-0-0x0000000000220000-0x0000000000243000-memory.dmp

    Filesize

    140KB

  • memory/1484-2-0x0000000000401000-0x000000000040F000-memory.dmp

    Filesize

    56KB

  • memory/1484-1-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1484-3-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1484-4-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1484-5-0x0000000000220000-0x0000000000243000-memory.dmp

    Filesize

    140KB

  • memory/1484-6-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1484-7-0x0000000000401000-0x000000000040F000-memory.dmp

    Filesize

    56KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.