Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    27/07/2024, 07:40

General

  • Target

    7767331daa805f22feef52c1b6c13581_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    7767331daa805f22feef52c1b6c13581

  • SHA1

    83f1b74a428b75da87f8d77d590800d415db629f

  • SHA256

    713297785ea311453c4a0341a8deca3bb31e53d4437cc55d195681d69121fe93

  • SHA512

    be6acd556309674aed54c920b841431a77c9833562541035425beca26f3d916a1c2f8d64f3ded245b4f99445cfcbf091e9c41f1e1bd7f7991dff00250785f1b4

  • SSDEEP

    384:bleGfhKB76kSvTSPSmDMjdfd6ZzlodATLo:RXfoB7wvTeWe1li

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7767331daa805f22feef52c1b6c13581_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7767331daa805f22feef52c1b6c13581_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Executes dropped EXE
      PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\server.exe

    Filesize

    9KB

    MD5

    cdf5cf0e177cddb54e0541dfdc420b2b

    SHA1

    827558e383091ab11a4bae0251ad436fa98f9580

    SHA256

    1a2eb5e057e80535603601b298507a1ee30dca5318b47100776446e6b3fe44be

    SHA512

    7f1016b733facf0cb8382dc5546a2f7c67e13a36e2308319e0651ecabc9eba1caf3b3f1facbdff36918d385fea896f0d6319e4b5f977b8ef85c7626bd0b72a71

  • memory/408-0-0x000007FEF681E000-0x000007FEF681F000-memory.dmp

    Filesize

    4KB

  • memory/408-9-0x000007FEF6560000-0x000007FEF6EFD000-memory.dmp

    Filesize

    9.6MB

  • memory/408-10-0x000007FEF6560000-0x000007FEF6EFD000-memory.dmp

    Filesize

    9.6MB

  • memory/408-11-0x000007FEF6560000-0x000007FEF6EFD000-memory.dmp

    Filesize

    9.6MB

  • memory/408-12-0x000007FEF6560000-0x000007FEF6EFD000-memory.dmp

    Filesize

    9.6MB