Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

61b8ecd4c6...18.exe

windows7-x64

7

61b8ecd4c6...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2024, 22:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61b8ecd4c6f7d3c93c8ee815f30f3610_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    61b8ecd4c6f7d3c93c8ee815f30f3610

  • SHA1

    3a8587e5f8273df4e902889744edaedaca9f0253

  • SHA256

    22d12c22fabb549b59288d72001a35af6a42c567be87a730f57b1672021e1ce8

  • SHA512

    3e88961df74ee600b3606a2b1ae069a095605de2e059c429301b8e86467d3b5dec70fc1b7356daa9649935002f8c72c68773335ecfa85460bfc819311c142bd3

  • SSDEEP

    768:pzviazESMuNIIAaFRzRr33A2CuBIotWkiI5rgjhKfe9pSL0wOthziRRndCIu:RavuXZ3zx3NCWvigMjQfe9ELchziF7u

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61b8ecd4c6f7d3c93c8ee815f30f3610_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\61b8ecd4c6f7d3c93c8ee815f30f3610_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2528-0-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2528-3-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

    Download