Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

29718855a5...18.exe

windows7-x64

7

29718855a5...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Dll/Regdll.exe

windows7-x64

1

Dll/Regdll.exe

windows10-2004-x64

1

Dll/unRegdll.exe

windows7-x64

1

Dll/unRegdll.exe

windows10-2004-x64

1

Dll/web2pic_url.dll

windows7-x64

1

Dll/web2pic_url.dll

windows10-2004-x64

1

Help.chm

windows7-x64

1

Help.chm

windows10-2004-x64

1

Web2Pic_Pro.exe

windows7-x64

4

Web2Pic_Pro.exe

windows10-2004-x64

4

example.bat

windows7-x64

4

example.bat

windows10-2004-x64

4

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 22:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29718855a5fdbc6fbcaefe19c9c2b820_JaffaCakes118.exe

  • Size

    882KB

  • MD5

    29718855a5fdbc6fbcaefe19c9c2b820

  • SHA1

    304e3c00ba8f756441bd722beae8eecfd88bd9b7

  • SHA256

    f686f33c05d63eb019164da669495fbb53c181d4d39603d03018afd883a923e9

  • SHA512

    9e12e6ed32e21f3c0ab253a18dfb4cc313c467431b5146816c661bba52d90154483a5040de9b4ff97826b67ee61a58db36c42aec85cb0fd4106d24eb850c8bf9

  • SSDEEP

    12288:u+ZqJGa2fSkdzp3Kx4ofEDkpx4JYlsW0U4sl8S2taZ07GynF1ZYxHBYCC+ghI3:3ZqQB/9PQxiUTWPtQ07zFclDCu3

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29718855a5fdbc6fbcaefe19c9c2b820_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\29718855a5fdbc6fbcaefe19c9c2b820_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst279E.tmp\ioSpecial.ini
    Filesize

    702B

    MD5

    4209be56495e2ae1d3f123ea59aa5762

    SHA1

    e76c79a6a35337569ae68713fa885731c8c10803

    SHA256

    3676fed73e6d0d262f903a976b5906d706ac1a1cbf3a90e69d0e2f46958825d0

    SHA512

    20f6883d1b9f5ebded2988b9e6e37ef8fd03ce26b9ef38171fb8f30f9eba846ae9db96eb0a834935d522b41fc0378fcef2af829d13a5f3fd70790b06a95af7d6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nst279E.tmp\InstallOptions.dll
    Filesize

    12KB

    MD5

    9aff00ec14e6cb71a13451011c580077

    SHA1

    5972140e4a0addb9eac685fe6037da7479f23ecf

    SHA256

    cc8145683ad8fd77bd5cca193e84188e40d6d03a0a0d1d00e2bdbef91be96bb3

    SHA512

    311abd4e9927c1424d794ba401f3935ad3b108a2124e58e0d29aa946514c7a1d62b9b08b013699f4f90796bdfb6c07211daddbb521c1d20ccee771f6ea43b110

    Download Submit