Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2024, 14:08

General

  • Target

    6ac97f2adaad0b92fa522d9bef189ae4_JaffaCakes118.exe

  • Size

    469KB

  • MD5

    6ac97f2adaad0b92fa522d9bef189ae4

  • SHA1

    5867a7137b4346ab95587fb84d2076411675a438

  • SHA256

    2d54e0a38b0f02e204233f6a842d765fc7efb0e72f35302493e60bcdfd841a17

  • SHA512

    18bb7db75a4cfdf562fe06e8cae7d11cbcb076bf38200d3e7cdc21020332363d96125ea733ea7c9e25f06c83d0df5565833b3098e0d655fc225b867ecd3e82fa

  • SSDEEP

    6144:xHLH0vFx4P+rvMGF63MBjMTeAs8nkC26n+W0Z90kOgqtn/SV1yCxD5/mORO5Ci:ZwvFx4IU9cBOeT96+HZDOUV8CyO7i

Malware Config

Extracted

Family

raccoon

Botnet

93d3ccba4a3cbd5e268873fc1760b2335272e198

Attributes
  • url4cnc

    https://telete.in/opa4kiprivatem

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Raccoon Stealer V1 payload 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ac97f2adaad0b92fa522d9bef189ae4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6ac97f2adaad0b92fa522d9bef189ae4_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2488-2-0x0000000000220000-0x00000000002AF000-memory.dmp

    Filesize

    572KB

  • memory/2488-1-0x0000000002E60000-0x0000000002F60000-memory.dmp

    Filesize

    1024KB

  • memory/2488-3-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/2488-4-0x0000000002E60000-0x0000000002F60000-memory.dmp

    Filesize

    1024KB

  • memory/2488-5-0x0000000000220000-0x00000000002AF000-memory.dmp

    Filesize

    572KB

  • memory/2488-7-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/2488-6-0x0000000000400000-0x0000000002D03000-memory.dmp

    Filesize

    41.0MB