Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 16:56

General

  • Target

    4a92150fdceebaf1fbbe41f77c32b08d_JaffaCakes118.exe

  • Size

    420KB

  • MD5

    4a92150fdceebaf1fbbe41f77c32b08d

  • SHA1

    81888b98d6e31e1172b006cb99044d2e49131b49

  • SHA256

    757835ab87630e6fa3acd36b97bea5301e7c0c2b67775440c02837f3a56a12c1

  • SHA512

    43cc14ba4e8e7a8dc218a561c0a6944adc8f2aea23003fce4b985be3ed48e03fb7e17c3a0a53acd8dceabef47ee40c51ab62e5e2e28f3d2dd8de4e238dc91d76

  • SSDEEP

    12288:a+cwkXKkfj04/MAyWxg6iI2dpx+j/jCm1Xj4:6wkX9b3UAyF60dX2j710

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a92150fdceebaf1fbbe41f77c32b08d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a92150fdceebaf1fbbe41f77c32b08d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 408
      2⤵
        PID:1648

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1648-3-0x0000000001F30000-0x0000000001F31000-memory.dmp

      Filesize

      4KB

    • memory/1648-5-0x0000000001F30000-0x0000000001F31000-memory.dmp

      Filesize

      4KB

    • memory/1736-0-0x0000000073D41000-0x0000000073D42000-memory.dmp

      Filesize

      4KB

    • memory/1736-1-0x0000000073D40000-0x00000000742EB000-memory.dmp

      Filesize

      5.7MB

    • memory/1736-2-0x0000000073D40000-0x00000000742EB000-memory.dmp

      Filesize

      5.7MB

    • memory/1736-4-0x0000000073D40000-0x00000000742EB000-memory.dmp

      Filesize

      5.7MB