Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

236c7dc448...18.exe

windows7-x64

7

236c7dc448...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    134s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    236c7dc44879c42cb185317d60cc918e_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    236c7dc44879c42cb185317d60cc918e

  • SHA1

    6512c67bd5e88a7061f5477626d01250a5b3161d

  • SHA256

    d0999c51c3a7d760c0aaee19a967f4c1d046dcfbba9f08a7a7dfd95daad44840

  • SHA512

    6c3d34d2a5c1bc9b4d41ffbe4a5cf12d4e55d14d309fc1a603d890bcf5203611a3b717246f9ff6270cbbe5de4adeb1b2e8aa75307ac1cd53c42114cfdf93784b

  • SSDEEP

    24576:L7a8VNSAyflJx1EabLV6j6pPZ9KVxqLFz4xAvdQGdU5SWsjk+Z9SfzHDPGznYMKi:f1vyfvzfeGd4xAFe5PsAy9wzjinsi

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\236c7dc44879c42cb185317d60cc918e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\236c7dc44879c42cb185317d60cc918e_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:4764
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
    1⤵
      PID:3584

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\E_N4\HtmlView.fne
      Filesize

      212KB

      MD5

      2ede898c7514c9e39f35ceddd81c5d77

      SHA1

      c6fcc2f2dbe73965f7ebf57dd9698bea36fe329e

      SHA256

      23d4ba69a2faee06850c146ad5268166e33d32871ff613093ab4c30136763c9a

      SHA512

      494dbeac30e379528aa7ef3c26767a83952b207e92589cd83501398229d06f1e5fee93a425ae99427f7e21d9b76fbaf3d16f3aa22eafe594769c8391f1d8f093

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr
      Filesize

      212KB

      MD5

      4d290c2bef7cf9f579a6626bcfd0f7ad

      SHA1

      0ec7ebf35e6581a81f3fd848eab8c7f7f9a558df

      SHA256

      de8128a30113485f88f37a64b4f17cf9369a96d21f195b766d79e738128fc561

      SHA512

      cfcab53112deae5eaa8842dc1db36b81099206742b6bc902fa97da4fe9898304ed489d5b54f628b5cad0eccc71d66c8a0ccb72e53b6ec96b1d2f880937869e67

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\E_N4\iext2.fne
      Filesize

      460KB

      MD5

      9d1365607194f4194820ac5a280e2682

      SHA1

      1e9078facfca07e2d5e0ced63873a3a1a143de7a

      SHA256

      5ec3d6e7985254ad2b03a66dd6ad2be60031d7828b8e8333944fdf4663df8b2e

      SHA512

      8e937fe2fa0260af67ec7df30b5ccbd68b56feddfa91b37053d2c8320a5f2919448fd5fe277efd112511ab2cfa5a785e3d32f323cd32df94ba14d0215116cf76

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
      Filesize

      1.1MB

      MD5

      c8682c920c4ac48ae391cc080e8981dc

      SHA1

      6c7876244684fe8a4097d6cd2e773ae84f4edfbf

      SHA256

      0e4c846c2b2095ee850544741adb95ebcbe90ac464e710aea2e02f5be56c94f4

      SHA512

      91487abf3ad8a6de60239649ecdf2edf3ddbad0c637819ab1814fbe47fd39d36f2d6187449c8952aff11aaa7a8ee814d7afcf3576b3491e4b4909fd97c49f090

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\E_N4\shell.fne
      Filesize

      40KB

      MD5

      60de3a04fd5aab1882a6d884877a7901

      SHA1

      eb4990a9428ac33f8a3bcff46053476e4cb79497

      SHA256

      876592da472e604d762bd577879f791b5f558e7b1115e40018a3c0b666a41939

      SHA512

      ef0eb1b5d45d383c6dd81b186a76d139ea627d46187fc392d4cf24a41f74ce61a44458cf4f3452367b73f40a2bd3bf67284411c8a155412048c6e8098d5e7c98

      Download Submit

    • memory/4764-19-0x00000000006B0000-0x00000000006F3000-memory.dmp

      Filesize

      268KB

      Download

    • memory/4764-18-0x00000000006B0000-0x00000000006F3000-memory.dmp

      Filesize

      268KB

      Download

    • memory/4764-2-0x0000000000400000-0x000000000045FF11-memory.dmp

      Filesize

      383KB

      Download

    • memory/4764-0-0x0000000000400000-0x000000000045FF11-memory.dmp

      Filesize

      383KB

      Download

    • memory/4764-26-0x0000000002480000-0x00000000024B8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/4764-25-0x0000000002480000-0x00000000024B8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/4764-1-0x0000000000401000-0x0000000000447000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4764-32-0x0000000004990000-0x0000000004A13000-memory.dmp

      Filesize

      524KB

      Download

    • memory/4764-11-0x0000000010000000-0x000000001011D000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/4764-39-0x0000000004B60000-0x0000000004B71000-memory.dmp

      Filesize

      68KB

      Download

    • memory/4764-40-0x0000000000400000-0x000000000045FF11-memory.dmp

      Filesize

      383KB

      Download

    • memory/4764-41-0x0000000000401000-0x0000000000447000-memory.dmp

      Filesize

      280KB

      Download