Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 18:02

General

  • Target

    c955ffbaaa45f7e3fcf0e311c80f4802_JaffaCakes118.exe

  • Size

    3.0MB

  • MD5

    c955ffbaaa45f7e3fcf0e311c80f4802

  • SHA1

    6c32a3e02df202b195d57ea73ee9f79136c04de3

  • SHA256

    e64bc1178bcbe5bd3dd00727011f5a5431f58e54992cced32ff2d360b0816eab

  • SHA512

    f8a972c7113e45772a01166a0ba2ef4d8b807d62f5d2bd62c7d29a2e28be9bb9fcca092f0771533c0bedb3c0f2128e534230966e055076a8c17b29f683fb2760

  • SSDEEP

    49152:Ip+t31lEjJzGdw80Bf6IL1+qMgPRZ3kpBj9CtQrnYdI0yhVzahbO2pQWh9bR2:IpmhNwhvP/gBj96QzU3bQqbR2

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c955ffbaaa45f7e3fcf0e311c80f4802_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c955ffbaaa45f7e3fcf0e311c80f4802_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files (x86)\BitTorrent\BitTorrent.exe

    Filesize

    1.7MB

    MD5

    1ad030e5c0bac97dfc026e4570528d60

    SHA1

    a4f6f34286089862d7958e6a680b10541e8ec47c

    SHA256

    8f3910c6a341ef3a4ae1e5f322a304cd320ee3973733c617efcf8558d84c1a4d

    SHA512

    bd6bf0cfdb97aa1950f7bfef80c5c1f9dac0aa66515dfe87f452e952aa38462d0044a8b1370535d9f4d108173756ad42a680f4850715800692a52c9cb8a89222

  • memory/2500-10-0x0000000002260000-0x0000000002270000-memory.dmp

    Filesize

    64KB