Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3a1af6d42e...18.exe

windows7-x64

3

3a1af6d42e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 17:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe

  • Size

    91KB

  • MD5

    3a1af6d42eff024b4431639239a0e47f

  • SHA1

    6c61094724382a0898bff48b043e08685c3d972d

  • SHA256

    fffe9e227694ddd0a0eb37e749f743c22f4728748c3a7c4a5801bc793b0ed2c8

  • SHA512

    2fbb64fc7c509f18a36b08874049e1f3c7dc459f086b5ed313209b7d8f48fbf8a554e26e644226af6a556cdcd75f4a844366ce547cc40ab02380f23261487de8

  • SSDEEP

    1536:KdLEO4TeqI4D/w/S8yYVDcBuuYSQMxZXB448oIO7V2TXbE59sVg0xdy7sd5:gfsewY/S8y4Qh5L58AKXbnfdywr

Score
7/10
persistenceupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3a1af6d42eff024b4431639239a0e47f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3048-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3048-1-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3048-3-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download