Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe
-
Size
597KB
-
MD5
279d9e256f6d5cfb934df03b1b5d9cb2
-
SHA1
106cd1fd36820904de1ea879b4263f0ab68ebeb7
-
SHA256
a51d7c34b22ae9aa40fdcbad555258e11f9c2198ae75c65008d05fa69380e4ad
-
SHA512
5808a822303096870af07765a9df5f1712914d571af963e4807671d63692ad0b9bceddcd74541e51e363da18091735fc5467d3f350375c0f7945833ceb85592d
-
SSDEEP
12288:mkbqHlPEFmm1OKmRrsPxS1pWyJxsQlUT19sMJxNfWN3hf6U:jboRBR4U1FsQluUyY3hff
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2816 2540 279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2816 2540 279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2816 2540 279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2816 2540 279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\646.bat2⤵PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597KB
MD5279d9e256f6d5cfb934df03b1b5d9cb2
SHA1106cd1fd36820904de1ea879b4263f0ab68ebeb7
SHA256a51d7c34b22ae9aa40fdcbad555258e11f9c2198ae75c65008d05fa69380e4ad
SHA5125808a822303096870af07765a9df5f1712914d571af963e4807671d63692ad0b9bceddcd74541e51e363da18091735fc5467d3f350375c0f7945833ceb85592d
-
Filesize
175B
MD5c563e205ad6e5015fddee649fcf43c3d
SHA119fb93573e24845cd9e639a258ea90a417e4eed7
SHA256760e51bbcdd794ae1a69d97a72c100f23d52c9e405bdb459e60d83f75682c0b3
SHA5128bca77c97e7c4af56af3708fafbfc9dea08167d125cc9d8e133ab01eb666b2e2b53257ef75677456f8a2c953473edb30f9212a1ae3a1c304623b1b048367db89