Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 08:05 UTC

General

  • Target

    5fae51c85f347e3729ad76b4c4d55619_JaffaCakes118.exe

  • Size

    403KB

  • MD5

    5fae51c85f347e3729ad76b4c4d55619

  • SHA1

    d001b97bbd84e427707096e275bf6637c191635a

  • SHA256

    7b23ca28b5a0cc231a9cce83991c0e309d05101d2de3de20da6310482e2fa272

  • SHA512

    3044d3141513ccd4116686ecb77f741cee961790d3e587cc55fbc4d69527421576bf0529ab219b70e8ff6a102cf538025e56d3d3c97e67023620ae0047607cce

  • SSDEEP

    6144:CVgL8KepFCIzKMyMrgWRDzAlxSSR32WlfDk5+mvtBR3kRMXCfLLb1ly1HH:v8KsFC8yMrghxJD7k5btk2XCjTEn

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fae51c85f347e3729ad76b4c4d55619_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5fae51c85f347e3729ad76b4c4d55619_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 296
      2⤵
      • Program crash
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2088-0-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/2088-1-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.