Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

67a1db6456...18.exe

windows7-x64

1

67a1db6456...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 12:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    67a1db64567111d5b02437ff2b98c0de_JaffaCakes118.exe

  • Size

    340KB

  • MD5

    67a1db64567111d5b02437ff2b98c0de

  • SHA1

    fe6312593a9f11ca49e7327c7f9c69c8df5202d1

  • SHA256

    d1cefad80cc23461093164d79ecba7699c6cc3965170d4a03ae575cddd04b1ab

  • SHA512

    3cb420f2a2146ff18c48c539fcb23f5daf2b658b528eee2acae3713007f154b384ea742d9ab349ff99fef40e371ca8c98166872720816ccb9465570383a76d10

  • SSDEEP

    6144:2H8fuKABZWWzbE3oS5ySwY7mKJ0ekbZ5aKs2f6iXWqC8EPZEu:l+ZW4E3vwG7mKJmbuKBpXTEPZEu

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67a1db64567111d5b02437ff2b98c0de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\67a1db64567111d5b02437ff2b98c0de_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\vcmgrd32.dll
    Filesize

    23KB

    MD5

    3f3381992db6f8ab2257a0dcfdf2d0d2

    SHA1

    c252a9dcdabcea31cf0bf10c2b06dc8855fbeb6c

    SHA256

    d54446956d70b4c55b65cf99d572de7d38a2197ae353fe14e6ef9db3c5ef74b5

    SHA512

    80c80ca49c97a54af7c4a8d77e472094f020deac1dab1892e0038dd2856b2f625b5aaf47b833f9069739092f10e65b1aab54c120e3ea596bdbd6aed42ddacfc8

    Download Submit

  • memory/3424-0-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

    Download

  • memory/3424-8-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB

    Download

  • memory/3424-10-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB

    Download

  • memory/3424-9-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

    Download