Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...30.exe

windows7-x64

10

JaffaCakes...30.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 02:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_0168ed53164a66c16ca9baabcc916b30.exe

  • Size

    1.4MB

  • MD5

    0168ed53164a66c16ca9baabcc916b30

  • SHA1

    15bf3131983057af2e804f286958ded02e48d632

  • SHA256

    f4025f7b532ab5b16a9a9e2759673e0692510e5e39453ea3281368c036dcc0dc

  • SHA512

    a5f224d03fd5518fec97f4ef1a3f88cb810f6760a64ddd3585c3305c9b5e55d6c2a72d29048d379f2cdaab47ec6ba9e29e4d7bc5b21e266c60d97edbc8d44248

  • SSDEEP

    24576:6HNF3HcAnuW7FwFU4yHgrQyAqx+3EzCqO2Uz1L7pryC1dhV3DxfQyRrFfC:4F34MFpk1nGqE1hr31pdoQRq

Score
10/10
salitybackdoorupx

Malware Config

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0168ed53164a66c16ca9baabcc916b30.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0168ed53164a66c16ca9baabcc916b30.exe"
    1⤵
      PID:2596

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2596-0-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

      Download

    • memory/2596-1-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

      Download

    • memory/2596-2-0x0000000001DF0000-0x0000000002EAA000-memory.dmp

      Filesize

      16.7MB

      Download