Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2024, 08:34

General

  • Target

    451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe

  • Size

    1.7MB

  • MD5

    451036dfa1fc0e15964fe6292f1e03ae

  • SHA1

    1ca90e2ab12d2bca1cf09277af60cfb3b9da88c8

  • SHA256

    6227073ec7fd458d7765e59f55dbb20946b0ddf7d50180f7e2853daeb8c36a26

  • SHA512

    7bb3ab37e1e245db49a0cf5529c81e2048ad901a41850a0f075b3ad8ca236cd5f72861a90825ee9ae2069216f192ddfd8c294d36495050e995ebc1fa82e0f143

  • SSDEEP

    24576:3t+PGXJIYJgv8E32bpXnKKLA3FEQTdHUOD0/WkdmKaMaOhhKJ:dJXJQ32l3tLtIHXAOkdmn

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies registry class 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\451036dfa1fc0e15964fe6292f1e03ae_JaffaCakes118.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mirc.ini

    Filesize

    915B

    MD5

    63a8ac4a048b63b558f816c1d690065f

    SHA1

    4792709596955c8077d56f18daff771b528e2faf

    SHA256

    7a69cef7a4af2649fc80b10fb9ca6c1ff0a9a76fea7127ef0ff11571d863a162

    SHA512

    8ed3628e1f37ed930d75f85a45d213a2209e36a7f8df44a784539acdc49d9d9898b7f109bc59cdb6bb7b8bf05abae90d667b1942c582e68c1fe4641932654197

  • C:\Users\Admin\AppData\Local\Temp\mirc.ini

    Filesize

    875B

    MD5

    a7afc3ee8eb79b3ec537d557067aaa5a

    SHA1

    5dc296dab63520e831345311aa0d765c41bbe10f

    SHA256

    48143eadea47adac233d8d1eb536f9992eb04ee2a5f3efc66798279931191df8

    SHA512

    1083a7af3b67fb8fafae1fa10ae80d799cf3c016ede54938add4520e4c45d472b999764e18616f62e3ddf1bcb9b285328c307f841a33aa7fcc3f8fe3b4da9559

  • memory/2496-183-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-184-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-179-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-180-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-181-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-182-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-177-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-178-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-185-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-186-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-187-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-188-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-189-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/2496-190-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB