Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 08:36
Behavioral task
behavioral1
Sample
386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
-
Size
357KB
-
MD5
386a01b038a6bb7cf34a7970e6609653
-
SHA1
f2db6eb4637951dce4885256d902198769f02cd1
-
SHA256
3437c43183aa87ac59294373af447fd4467675495bc8ff298c07c302e3b2f44c
-
SHA512
21e588ed823ff4b17703bf95f05a495d45808a114d07193590c9b8811b6e530cb7a65b10d7c3f3435d85a9dd65248b66d8345c0c0d44b43303f275ffcf29f153
-
SSDEEP
6144:p8yZw0EMTNHw7Ip+rKUEqpjyfe03qJf1zw4T/+8zXTfwcDKl+oSUx:GZ0btw6+rK5qkfe03j4j+cD4choS4
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1748-0-0x0000000000400000-0x000000000050A000-memory.dmp upx behavioral1/memory/1748-11-0x0000000000400000-0x000000000050A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1748 386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe 1748 386a01b038a6bb7cf34a7970e6609653_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5329793ad730a353c53f342fb7d1dc9bc
SHA1727a5e6ffaed00ec8ab0743779e4f03cbed139c6
SHA2567fc846617b0513828d63cc6edf12ac6e4df8948f4ea27df2d2b499b07105ef7f
SHA512d7362870745fdbec32bb8c507438d536fe3fc7d2585557c2941301d7dbde59621d236c745d681b7e7879d3b362663e690255c2019e011fe6a975a5a2abba8d4d