Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 10:41

General

  • Target

    4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe

  • Size

    24.1MB

  • MD5

    4c79dfac9072c6e3d7575e8b02ddae7b

  • SHA1

    9667a01ed7873a0540733130c89d4f53df2b54da

  • SHA256

    6e7d973ed5250d9755b3d6f22884262226befeaf4cca538729d31a691ff99e11

  • SHA512

    ae53e0fce49430671d671d9792d7e9481aee38e2c67f4aa017b5df41f6d9f18df18628f83b9457457d46ff466368c6741f7ca80e2875db07ed46d522a4f30d50

  • SSDEEP

    786432:sZCEDVfjrRj0r6+bUno0j4ILgtN35TbdXT:2CYbr50rVOoSK53t

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI26602\python39.dll

    Filesize

    4.3MB

    MD5

    1d5e4c20a20740f38f061bdf48aaca4f

    SHA1

    de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

    SHA256

    f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

    SHA512

    9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397