Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

f27ff6d724...18.exe

windows7-x64

7

f27ff6d724...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    137s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2024, 02:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe

  • Size

    390KB

  • MD5

    f27ff6d72495c5bebe7e3411462dacc9

  • SHA1

    52782e81abe0cee64cbcd91cbfb4e8cc0765ba02

  • SHA256

    e21ca893ffd12b220aa810c7190736b3ffc0a39349613965ca91fcd23c62f725

  • SHA512

    871f241d2eacaaf40992899b82ba9b627baf56779e8c1140f9f092428272740abd525c1228185128b70a05c6d2d87398bca1d625d38b5bec99b57c9d8b5d065f

  • SSDEEP

    6144:3A0dN4AcyOXBVPdez+FzZjsKkSFCiuS77etKvGpE+a/jYoSuOfMeOoxSn7S94EeN:3A0dN4ZjPFZjs95iuS77WaLmlMjz9

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\ProgramData\hE04903IhNoP04903\hE04903IhNoP04903.exe
      "C:\ProgramData\hE04903IhNoP04903\hE04903IhNoP04903.exe" "C:\Users\Admin\AppData\Local\Temp\f27ff6d72495c5bebe7e3411462dacc9_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\hE04903IhNoP04903\hE04903IhNoP04903
    Filesize

    208B

    MD5

    472e5bcdd47091810af0036bf0518074

    SHA1

    333325532d79f2480eb8d3f227b31751719f9eec

    SHA256

    351d7d45e37547db9a9d47966d81e5c485801c29f28db04819f702654e6127cc

    SHA512

    2b3181db455465bc1ceb585466864fead7ba2ca39ee59066d6136000d43b4570d4bc5e0b851431dae7cd7577e06233dfc8a4e34b2accbfd8a650966e6d95b98d

    Download Submit

  • \ProgramData\hE04903IhNoP04903\hE04903IhNoP04903.exe
    Filesize

    390KB

    MD5

    5d6a22ff4bd5a088a66534017980febc

    SHA1

    80f2401aa4b69cd02ba92e14ca58f97a4805b49e

    SHA256

    259196c874330e7c7fa2dd0457fa037a1997e7240bc935908e08c8466e2d62be

    SHA512

    9dcca3bb1e409f31d7439ae090d6e19aa87849122a77ef332f38a1352c72a0951304b77d80b59007ce70de9a085a108705109844ccbd85828114e9c3d6ada033

    Download Submit

  • memory/1680-0-0x0000000000240000-0x0000000000243000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1680-1-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

    Download

  • memory/1680-2-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1680-162-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

    Download

  • memory/1680-195-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

    Download

  • memory/2592-86-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

    Download

  • memory/2592-87-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2592-165-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

    Download

  • memory/2592-201-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

    Download