Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

9593785e0c...18.exe

windows7-x64

7

9593785e0c...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 09:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9593785e0c294a2c57be27e3ead74a06_JaffaCakes118.exe

  • Size

    660KB

  • MD5

    9593785e0c294a2c57be27e3ead74a06

  • SHA1

    37282ca6e7504214f4de851399df9d45eebcc82b

  • SHA256

    9411664ee9736c9ea0cdc72c556050e96c5e2fdd05c420138a21534b0087f567

  • SHA512

    e7db3f80f4da017cdd17f8774779a580c7ca27e24b18029a2f5c51ee0aa65a3bc85ad9427d0326805b4feb51f1cb75ad56832b64d3320c22e2c6d8356556de63

  • SSDEEP

    12288:AuZjwD8XKf/ytQI7Izy909ys49WHnW6ia0znC5sEUV1C5azlQ7r5G3I9h:1RztQy909qWHfV5sEU+ay7r5G49h

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9593785e0c294a2c57be27e3ead74a06_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9593785e0c294a2c57be27e3ead74a06_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
    Filesize

    1.1MB

    MD5

    638e737b2293cf7b1f14c0b4fb1f3289

    SHA1

    f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

    SHA256

    baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

    SHA512

    4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

    Download Submit

  • memory/2088-0-0x0000000000400000-0x000000000042B6EC-memory.dmp

    Filesize

    173KB

    Download

  • memory/2088-4-0x0000000000400000-0x000000000042B6EC-memory.dmp

    Filesize

    173KB

    Download