Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 16:47

General

  • Target

    74e422a6bf0e1cf71ae14c46f5756e55_JaffaCakes118.exe

  • Size

    729KB

  • MD5

    74e422a6bf0e1cf71ae14c46f5756e55

  • SHA1

    901bc0ae05063b4313c39619158b98628eb90a7f

  • SHA256

    9a46957f60e81f9ebf8bd0dc853ada33ad849cd8a7e19208efed41f6bbaa5fdc

  • SHA512

    1c14975fb6aec5d94344ce30542a3d67e8c969ecffde1d82511e87675f2457ef7dd4d71fe4001d02a7dfff7c7b3d370fb6536ef5c377eb862e1698d95ebd75e0

  • SSDEEP

    12288:C3R3vxPBuav4mPZhyK6KGZ4B7sgcy0PEH3MJ/vy3yi1X6DP7BHH:CB3BBxJl62b10Pi3MZDi8DTBHH

Score
7/10

Malware Config

Signatures

  • Uses the VBS compiler for execution 1 TTPs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74e422a6bf0e1cf71ae14c46f5756e55_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\74e422a6bf0e1cf71ae14c46f5756e55_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2912-0-0x000007FEF540E000-0x000007FEF540F000-memory.dmp

    Filesize

    4KB

  • memory/2912-1-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

    Filesize

    9.6MB

  • memory/2912-2-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

    Filesize

    9.6MB

  • memory/2912-3-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

    Filesize

    9.6MB

  • memory/2912-4-0x000007FEF540E000-0x000007FEF540F000-memory.dmp

    Filesize

    4KB

  • memory/2912-5-0x000007FEF5150000-0x000007FEF5AED000-memory.dmp

    Filesize

    9.6MB