Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
09/07/2024, 07:39 UTC
General
-
Target
2f7f8e434f22d5557a476da1b398cc6f_JaffaCakes118.exe
-
Size
402KB
-
MD5
2f7f8e434f22d5557a476da1b398cc6f
-
SHA1
0b5d7c9b997814dce86010428a604fb7e803e157
-
SHA256
ca799166febd98e15edd129328412c276ec227c3a94f18d3501e27302970d722
-
SHA512
a0bbe6c14bca933404bd20919c8c78219ab0a93e6d9e475d86e6b06ebd00beef66d090c8d342f8dbfc0afb4ae409e8a1e7fc1497bb20c88c9bced96f68ff3042
-
SSDEEP
6144:2jQ/3jCf8Gb6XDH0GKzYPESX7M6/RfWrsrq21FAkv+iyfS8ARAtppMp2jP4j2vuR:1/3xJKzU7MAosfAP9qAYBj2vO
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f7f8e434f22d5557a476da1b398cc6f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f7f8e434f22d5557a476da1b398cc6f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
-
DNSdownload.32vegas.comRemote address:8.8.8.8:53Requestdownload.32vegas.comIN AResponse
-
8.8.8.8:53download.32vegas.comdns
DNS Request
download.32vegas.com
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5f6b6607d5594c3911e7f9d104420a7e7
SHA1895d9355e1848b405a92ed677c1ad2edecf77138
SHA256ab733c7618e96ae66d963115d89e63a1095af35778d417d2da79e365e5820f6a
SHA51242a4f21d50a811742def1491f3be2f30191f5abe8d25fe368ae3122068de8c0997b8aaec1e99d5609f0284df2d7f385edf40e5355f186b1fb84fbf2ee40cd1c0
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB