Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2025, 06:53

General

  • Target

    JaffaCakes118_fa1487e24cbe77d753ae29386a4517ca.exe

  • Size

    420KB

  • MD5

    fa1487e24cbe77d753ae29386a4517ca

  • SHA1

    392ab346b3fdf56a155d8d3fc12b2b08614c6814

  • SHA256

    569a180ba35ff0e22845237e9e77c25a8607b89bc956647438200dca7ad9841b

  • SHA512

    93de96ab92c22743207d1fc7ca39917d83018729675682879af745d2b58db578d8da090abcb4a5f54b90407afa4fd60c6985bfbff73ca6c9bff0c3ebf2f60ef9

  • SSDEEP

    12288:K68JoaMZIzBC3t0KJIOEIU9KdYfvyIvXCosu:xnaMZIzg/3URfvrSg

Malware Config

Extracted

Family

redline

Botnet

5

C2

80.87.192.249:16640

Attributes
  • auth_value

    3e4c638c72124e45bcf5164456741cce

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa1487e24cbe77d753ae29386a4517ca.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa1487e24cbe77d753ae29386a4517ca.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3060-1-0x00000000009A0000-0x0000000000AA0000-memory.dmp

    Filesize

    1024KB

  • memory/3060-2-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/3060-3-0x0000000000400000-0x0000000000895000-memory.dmp

    Filesize

    4.6MB

  • memory/3060-4-0x0000000000980000-0x00000000009A2000-memory.dmp

    Filesize

    136KB

  • memory/3060-5-0x0000000004AF0000-0x0000000004B10000-memory.dmp

    Filesize

    128KB

  • memory/3060-6-0x00000000009A0000-0x0000000000AA0000-memory.dmp

    Filesize

    1024KB