Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 02:40

General

  • Target

    JaffaCakes118_0168ed53164a66c16ca9baabcc916b30.exe

  • Size

    1.4MB

  • MD5

    0168ed53164a66c16ca9baabcc916b30

  • SHA1

    15bf3131983057af2e804f286958ded02e48d632

  • SHA256

    f4025f7b532ab5b16a9a9e2759673e0692510e5e39453ea3281368c036dcc0dc

  • SHA512

    a5f224d03fd5518fec97f4ef1a3f88cb810f6760a64ddd3585c3305c9b5e55d6c2a72d29048d379f2cdaab47ec6ba9e29e4d7bc5b21e266c60d97edbc8d44248

  • SSDEEP

    24576:6HNF3HcAnuW7FwFU4yHgrQyAqx+3EzCqO2Uz1L7pryC1dhV3DxfQyRrFfC:4F34MFpk1nGqE1hr31pdoQRq

Malware Config

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0168ed53164a66c16ca9baabcc916b30.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0168ed53164a66c16ca9baabcc916b30.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/924-0-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/924-1-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/924-2-0x00000000022F0000-0x00000000033AA000-memory.dmp

    Filesize

    16.7MB

  • memory/924-3-0x00000000022F0000-0x00000000033AA000-memory.dmp

    Filesize

    16.7MB