Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 04:13

General

  • Target

    2ef5bc7e3ea077223ddeb130e428140a_JaffaCakes118.js

  • Size

    183KB

  • MD5

    2ef5bc7e3ea077223ddeb130e428140a

  • SHA1

    2703976ee122a4f0a618fc69e53aa25a313cee7f

  • SHA256

    66ae152ddc0d2e4ec4836f7ab4d6c1822d3bfe746d34c8fc24f57f15e8e16ec0

  • SHA512

    cd4f2abf643beff86d75fcfbb48cabe1101db98c70720e8a75c60db59e94bc08846eaf4f7dc648277f7225e89ab559830984144e3a8c64894c9585a0149feab3

  • SSDEEP

    3072:aGTydvzf78BsUDnOMPTVjTDVoP9WhePMfa2A5izMAFKMulAXTMvBnPUSD5l:aGI7f7LUbZVjTJuWhePMCts4MRoZ55l

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\2ef5bc7e3ea077223ddeb130e428140a_JaffaCakes118.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\lzmzjnoci.txt"
      2⤵
        PID:1760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\lzmzjnoci.txt

      Filesize

      92KB

      MD5

      72e3da2f8357c43f4fdf82a9479a1c85

      SHA1

      0b3b520fdde7958f9d02e388130ff5f6dc3dc1b2

      SHA256

      b1d480ddc3655879f8639184af5f1e6441660dc37216a8079982046e6e60c6c5

      SHA512

      0892f05ec27661901a01015b3751d7575ecafd5468ab33fb157ceb5072a861a4b0d19cd8d0b8cfc89fadde4cb02a9e2e13d52ffbad35fdd1e728c15a9a8c7bf4

    • memory/1760-4-0x00000000025F0000-0x0000000002860000-memory.dmp

      Filesize

      2.4MB

    • memory/1760-12-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-19-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-31-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-37-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-42-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-46-0x00000000025F0000-0x0000000002860000-memory.dmp

      Filesize

      2.4MB

    • memory/1760-48-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-50-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-62-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-63-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-68-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB

    • memory/1760-69-0x0000000000430000-0x0000000000431000-memory.dmp

      Filesize

      4KB