Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 13:50

General

  • Target

    d21411a25440db7f85ec7e3e956170fb_JaffaCakes118.exe

  • Size

    641KB

  • MD5

    d21411a25440db7f85ec7e3e956170fb

  • SHA1

    5a944f848e770a4ac51dfa14b497fa349210ea6b

  • SHA256

    d29baa1d9020bff2f5b2c70b5e767539a22293b57a487bf8a0513f9eb429ccfd

  • SHA512

    9b5b313e83a620b2fb62e7dc8cd6f44e3a81d0234062e0863301819324b0ae4ec7ceb58d5cb646f2858f8ed0cacb4dc92ac7fa7853fb3068326d734090e77e9f

  • SSDEEP

    12288:0h3Q+kVHTlcgElBYnFfWA3mvPU0EfcxLZJFPwOAZ4iGcCRiN3uG:0h3vyzElsvXSbX2T

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d21411a25440db7f85ec7e3e956170fb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d21411a25440db7f85ec7e3e956170fb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\E_N4\INTERNET.fne

    Filesize

    192KB

    MD5

    c1180974dd8a7c6d9f8fcc13096b4f7a

    SHA1

    9d50021334248bf0c752b3ed34deed48325da05c

    SHA256

    5b1ff0cabb2384f4b6385c1acce1d5e3a9d7b8e0403e2224cd1ab9722a599d3d

    SHA512

    c8b938bf172b9d2ccfaea34ff7cfddc9eaab8a9416a07e458bd34dfed2ea18de66d23dbaa9f15c2faf1009e00a8dfca3168ab41f02ef28e97c9197c3ca6943e9

  • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

    Filesize

    1.0MB

    MD5

    4b30dbe1a79b2b7572ff637cb3765ced

    SHA1

    b08eba0e9bdb62d426db8d2b3d451152a56f79a1

    SHA256

    4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

    SHA512

    40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

  • memory/2248-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2248-6-0x00000000002B0000-0x00000000002EF000-memory.dmp

    Filesize

    252KB

  • memory/2248-9-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB