Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

1694dfdee1...18.exe

windows7-x64

7

1694dfdee1...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 06:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe

  • Size

    294KB

  • MD5

    1694dfdee136a7cc87b3d1b80092bb38

  • SHA1

    7177715cda51f3c59220c8e4c502b2f882c1c472

  • SHA256

    bfe80987b5ec031b5d4cdf89a2b6f296e9387132b12d35be720558959c5dcaa7

  • SHA512

    2f3084eda05d6b6ab60987ed7417e15e25cf2c2e59142c96078cee1a44d4af5c4fef1eb659329c311d7e41ccd9d1820a2cea48a962aad0e2f70072b531e8479c

  • SSDEEP

    6144:AkGd1DZxlWelOlMVDrcuJSsT4/ZOrss40AJq5aGI+MZX0RoeVJEmdX6P:AkGd1XlHlOqVncoTM4ssSJY3I+fVekKP

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1694dfdee136a7cc87b3d1b80092bb38_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TsuFF29D22A.dll
    Filesize

    267KB

    MD5

    0088a8b8a6bdeee89b3a7e17d01da6e4

    SHA1

    f0d46b59379c79c27ac5a38cb67740433f36614d

    SHA256

    429e4259ae65713991bf882507477768cd2adb14bca6f8191a4a31cefb3a7b24

    SHA512

    c8102dc9357db70ce0c2f7fc908bc32883576c007616dd5a297029edd115ffcdb756ef4c39d8c7cc274188ecc4d69d2be2470c34aaa4cc76d2da2e2003f1e81c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{3BCC2746-01CC-7CA1-9E4A-49EEE02F05B0}\_Setup.dll
    Filesize

    205KB

    MD5

    95dea87b4295317b6aaf85ce56c4f57f

    SHA1

    34d54e4dd7cd1a18754e54d0bd83880e41d155cc

    SHA256

    6db25bce80d2b8916438d09595a3bf443b146b5b49b22eef2f2478a95ea716a2

    SHA512

    c46af29d20994676f078996febe8141abdf90e96fbac8bc609aade8a49d5bfe51b027ac0f3e952f8393cdc9a2bec7855b199e662506883b356837f7f5aa21c72

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{3BCC2746-01CC-7CA1-9E4A-49EEE02F05B0}\_Setupx.dll
    Filesize

    42KB

    MD5

    66e0d3cb3825b658880be576875795bc

    SHA1

    740982ce3b3e4bd08c1cbd5fc8cfeb982f1d4e05

    SHA256

    27b7921fbbd360bf77db65a50b2cd9a600e6baaaf77fd60eee74476d9fc6c7e0

    SHA512

    23873b2052f66d3b5961cfd5ca26d4d3f507cbd0317116e6b773d23defe47c164e1040fb56392f17cd2644528c64dfbfdeccc46e1965a650786414c8f8f74c7b

    Download Submit