Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2025, 17:36

General

  • Target

    JaffaCakes118_70598ba8433e3a26d82c96d9326335d6.exe

  • Size

    905KB

  • MD5

    70598ba8433e3a26d82c96d9326335d6

  • SHA1

    e83f93689c40f3566959cdbbcc89972d7039c19a

  • SHA256

    fdae7bcf6b15f91acfab2b15935ed5061737145ee46ed8a88f08b218385d645b

  • SHA512

    178a0f0f0945a65a8eaa15ba073bc939cf19af416cbb3afe57c22046258419f7c6559b5c972e18ad78fb6b94082620eb342131a5c57afad17fd617926ee3c3f0

  • SSDEEP

    12288:Cl6BVYM+0b0pBp/A5b52oX/THDXKUzS4f9zNT7LhZSTEfNGHdpoxS/9/Ed8A:YUVYT4+D/B4D+0hZSTEF8dpJ/9/68A

Malware Config

Extracted

Family

redline

Botnet

@PrestiJL

C2

95.181.152.6:46927

Attributes
  • auth_value

    cdf3919a262c0d6ba99116b375d7551c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70598ba8433e3a26d82c96d9326335d6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70598ba8433e3a26d82c96d9326335d6.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2660-1-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2660-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2660-8-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/2660-9-0x0000000001FD0000-0x0000000001FEE000-memory.dmp

    Filesize

    120KB

  • memory/2660-10-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2660-11-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2660-12-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2660-13-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/2660-14-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2660-15-0x0000000000550000-0x0000000000638000-memory.dmp

    Filesize

    928KB