Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 13:38 UTC

General

  • Target

    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe

  • Size

    406KB

  • MD5

    1f2b7ec4709730896fbf557d3157baaa

  • SHA1

    b56be4441950893403b7e1a6b7c8972ef6b3ec1e

  • SHA256

    4bed0a8c5f5760ede547a9c559f14787dd738e0c70ecc125b2300ce111005436

  • SHA512

    855ad7be4e87d51f421a3537dc04d283e2be2d6f4cb8072a19f855fc772b4c26d095839b366c21dad1276131355d0554dfbb525fbbb29b2055c5df34d9a24789

  • SSDEEP

    12288:S1IE3GmvRelQhUW6gLLAn76dFirI96ZqSGsn:S1F2mZHhUW6UAzrI96r

Malware Config

Extracted

Family

redline

Botnet

UDP

C2

45.9.20.182:52236

Attributes
  • auth_value

    a272f3a2850ec3dccdaed97234b7c40e

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1968

Network

    No results found
  • 45.9.20.182:52236
    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    152 B
    3
  • 45.9.20.182:52236
    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    152 B
    3
  • 45.9.20.182:52236
    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    152 B
    3
  • 45.9.20.182:52236
    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    152 B
    3
  • 45.9.20.182:52236
    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    152 B
    3
  • 45.9.20.182:52236
    JaffaCakes118_1f2b7ec4709730896fbf557d3157baaa.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1968-1-0x0000000000C00000-0x0000000000D00000-memory.dmp

    Filesize

    1024KB

  • memory/1968-3-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1968-2-0x0000000000230000-0x0000000000260000-memory.dmp

    Filesize

    192KB

  • memory/1968-4-0x0000000000400000-0x0000000000797000-memory.dmp

    Filesize

    3.6MB

  • memory/1968-5-0x00000000003A0000-0x00000000003C4000-memory.dmp

    Filesize

    144KB

  • memory/1968-6-0x0000000000970000-0x0000000000992000-memory.dmp

    Filesize

    136KB

  • memory/1968-7-0x0000000000C00000-0x0000000000D00000-memory.dmp

    Filesize

    1024KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.