Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 22:38

General

  • Target

    0185bbadaecfaf35d399f198d302a77c_JaffaCakes118.exe

  • Size

    2.3MB

  • MD5

    0185bbadaecfaf35d399f198d302a77c

  • SHA1

    0530f5aff3cc71331d58aad927ad4abf10b14444

  • SHA256

    43829e246dd04336968552b496bb3ddfaa6847e8d296e42ae3a9fe2dfad91e06

  • SHA512

    590063f749c08b54d043769d845e91e374bc8aebcf330d12efb254d8d541fc81323dae603b1e1c733e97033f85dc728381787b0de28d94a7f691b8630f9751a8

  • SSDEEP

    49152:5CLDqigMXSNZQD5j3cLfkkKSalp4+Z/FPnWnLvJ3+EdBy0SWjuDR:ZxMXSNZQFcxgdtPn6xLBy1quDR

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0185bbadaecfaf35d399f198d302a77c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0185bbadaecfaf35d399f198d302a77c_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\idlj.exe

    Filesize

    75KB

    MD5

    f35c0109abb91e6e118bd9ad2fbafa78

    SHA1

    74290ff5b82ec24f36d7579a198349fdad7dc76a

    SHA256

    4b99b234713c443ae5b57eae9fada3267bd4a36f06e16f9bee82249b91d747cf

    SHA512

    e9f8a42df9d30c2fb3f7efa6705dea8e10479e9d85df45ebd9678953ed79654c576d909c794c83694280b233d404b8df85f1a1d6571ec4c5199ca3c625ac79c9

  • C:\Windows\SysWOW64\xdccPrograms\7zG.exe

    Filesize

    2.3MB

    MD5

    0185bbadaecfaf35d399f198d302a77c

    SHA1

    0530f5aff3cc71331d58aad927ad4abf10b14444

    SHA256

    43829e246dd04336968552b496bb3ddfaa6847e8d296e42ae3a9fe2dfad91e06

    SHA512

    590063f749c08b54d043769d845e91e374bc8aebcf330d12efb254d8d541fc81323dae603b1e1c733e97033f85dc728381787b0de28d94a7f691b8630f9751a8

  • memory/2760-115-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-116-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-111-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-112-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-113-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-114-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-109-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-110-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-117-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-118-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-119-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-120-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-121-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2760-122-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB