Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 06:45

General

  • Target

    2cac4bbc8c30a85f01857a7e1fa67379_JaffaCakes118.exe

  • Size

    196KB

  • MD5

    2cac4bbc8c30a85f01857a7e1fa67379

  • SHA1

    66aba59d1a3d953654e5b6d990e7d43d02dff798

  • SHA256

    b1c3f0306b9a7ac9ab2900b7125038f4aad6f886563ddfabace509fd145ba7b2

  • SHA512

    0842ebdab12e6c60a1d5dedcda566157ca4892fcaf137c653bd0000b5908cc85553be18ec32ce6d87b8232f04be55f3bb838cc0425c4c70dc46f00d46d1d871d

  • SSDEEP

    6144:ni22uJpPt/pzECWtN6TIDRIh/nLH1aEMWUVtT3IE49:ni22uJpPtYk6Zq9

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cac4bbc8c30a85f01857a7e1fa67379_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2cac4bbc8c30a85f01857a7e1fa67379_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\bassmod.dll

    Filesize

    9KB

    MD5

    780d14604d49e3c634200c523def8351

    SHA1

    e208ef6f421d2260070a9222f1f918f1de0a8eeb

    SHA256

    844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

    SHA512

    a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

  • memory/3052-0-0x0000000000400000-0x00000000004401A3-memory.dmp

    Filesize

    256KB

  • memory/3052-4-0x0000000000400000-0x00000000004401A3-memory.dmp

    Filesize

    256KB