Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    13s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 06:49

General

  • Target

    279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe

  • Size

    597KB

  • MD5

    279d9e256f6d5cfb934df03b1b5d9cb2

  • SHA1

    106cd1fd36820904de1ea879b4263f0ab68ebeb7

  • SHA256

    a51d7c34b22ae9aa40fdcbad555258e11f9c2198ae75c65008d05fa69380e4ad

  • SHA512

    5808a822303096870af07765a9df5f1712914d571af963e4807671d63692ad0b9bceddcd74541e51e363da18091735fc5467d3f350375c0f7945833ceb85592d

  • SSDEEP

    12288:mkbqHlPEFmm1OKmRrsPxS1pWyJxsQlUT19sMJxNfWN3hf6U:jboRBR4U1FsQluUyY3hff

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\279d9e256f6d5cfb934df03b1b5d9cb2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\646.bat
      2⤵
        PID:2816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\63413.exe

      Filesize

      597KB

      MD5

      279d9e256f6d5cfb934df03b1b5d9cb2

      SHA1

      106cd1fd36820904de1ea879b4263f0ab68ebeb7

      SHA256

      a51d7c34b22ae9aa40fdcbad555258e11f9c2198ae75c65008d05fa69380e4ad

      SHA512

      5808a822303096870af07765a9df5f1712914d571af963e4807671d63692ad0b9bceddcd74541e51e363da18091735fc5467d3f350375c0f7945833ceb85592d

    • C:\Users\Admin\AppData\Local\Temp\646.bat

      Filesize

      175B

      MD5

      c563e205ad6e5015fddee649fcf43c3d

      SHA1

      19fb93573e24845cd9e639a258ea90a417e4eed7

      SHA256

      760e51bbcdd794ae1a69d97a72c100f23d52c9e405bdb459e60d83f75682c0b3

      SHA512

      8bca77c97e7c4af56af3708fafbfc9dea08167d125cc9d8e133ab01eb666b2e2b53257ef75677456f8a2c953473edb30f9212a1ae3a1c304623b1b048367db89

    • memory/2540-1-0x0000000010000000-0x000000001010F000-memory.dmp

      Filesize

      1.1MB