Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3d3eacbcb8...18.exe

windows7-x64

7

3d3eacbcb8...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    102s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12/07/2024, 11:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d3eacbcb8ddd3a14cd05f563e608646_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    3d3eacbcb8ddd3a14cd05f563e608646

  • SHA1

    257e60a5c9dbf45bbfde2ac682568766845e903f

  • SHA256

    b1071193e2068bba87eeed70388d3fb822de9f055de2fa3d1ce7dbff7e80829a

  • SHA512

    3aea38b37c2a11929a8ed358cfed1074864d1809ff9ff227447c509484c38a5ec3f523805a86c69184872edc4f1e731c0255ed86d242086f2e4cf424bd83bf8d

  • SSDEEP

    192:9zlap1TvTqJlW/ZFCAxPZBJvI5wyf3LsQ8IPdraTNWHf1DraW9zHJq2BD7rP1oym:9z03nqJlkZ8QDCLpPMWf1aWe2BD/1o26

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d3eacbcb8ddd3a14cd05f563e608646_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3d3eacbcb8ddd3a14cd05f563e608646_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\3d3eacbcb8ddd3a14cd05f563e608646_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3d3eacbcb8ddd3a14cd05f563e608646_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\note64.exe
        "C:\Windows\note64.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\note64.exe
          "C:\Windows\note64.exe"
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\DkTemp
    Filesize

    84B

    MD5

    7e530db4f5deed16bc6b4587db5d2c39

    SHA1

    a34f0553c31c28206638a7e4832b2824a7da7996

    SHA256

    7c2b8a516b7a006bd4df2d658c5e9ec8356805f7f329166b5c49c5e8389e345d

    SHA512

    cf14575c9b706f9e1f33bfbc806a08c88f96e1abadfd66ee2a159fb3986b2aa4d8d53b16d79a92e5285bc272309baf879c4654a4e8df08a7c11f6a2b5ae6d68f

    Download Submit