Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
19/04/2024, 07:13
General
-
Target
f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe
-
Size
288KB
-
MD5
f9c870d2e4af62dff412d6ca65babb18
-
SHA1
7685d690c54281dc59afe696b07d4fa5acbe1cc4
-
SHA256
37bf70df08384ed0262f88b296f8b961c8b11426578971d2b985a7cbadcd0f21
-
SHA512
db05efd25166a70831586597dd82c3af85d3889eca32b07dcf108f78678e1c5014e7c50cc07879607a5629442f3c617db77506f64ffc0e4389aebc5c29c863ee
-
SSDEEP
6144:xX8JX6MQUXu+9qjCTWeqKas8hiAHlkyvbhA5qLXtE8VZP6lnrlZdgpP:usM7u+xWEAyeAGy8V168P
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\8AF89\C490F.exe%C:\Users\Admin\AppData\Roaming\8AF892⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe startC:\Program Files (x86)\8924A\lvvm.exe%C:\Program Files (x86)\8924A2⤵
-
-
C:\Program Files (x86)\LP\0F08\9AC9.tmp"C:\Program Files (x86)\LP\0F08\9AC9.tmp"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996B
MD52509b7ce1b0de5609fd200aa966de3dc
SHA19832df41dd1056a7a7edbd6601396d01990398b0
SHA2564894a94dcea14ceec10b6c2880da677c345df99e8476fb0ecba7547a36d14cba
SHA51208d517215f0733525e6826b269f4c76e01098cdad34eddcb9579a405e46fe690cef65ddbd25886b4cded750fe81bc70b0cd183c7bbbef7733e0bb340f77ac542
-
Filesize
1KB
MD5fffd9f2c5a5e37b6efea70c464870779
SHA1b8809a786d35bf935cce86202683d3e9572eb7be
SHA256e4405cf7c71ddd03e6c80c1f1548524e31231e765f3f94f76afe2352ec432009
SHA512f2186013470d52ae483224decbd0dd76c0f12652edc12206bec13fa682c51bea02185e12d5e209c672b6be9eb94c66758155d8174021c2953511abba5c890acd
-
Filesize
600B
MD5902ab1bdc73921f2bf0c300eca5edf3c
SHA1ef48aedeee381cfdfac98a0710bd1852e19dd76f
SHA256fba1d0fe1bad7812d6110c4a38930d2d231c88b99d0350c178d334dd98e205d3
SHA51282a708063c32e210d91f2f8484eb0b952c1aeb5ae3a3c2a51f4d2d4168bed74ffea78fb5f669a02997cdf2fdc595ee91083cf99bffb36807f5d0562aade7ee41
-
Filesize
102KB
MD53dd4e5cd0cb32f735268a740c647065a
SHA15e88431137152bf76f61d06b1c2086ecd5082a76
SHA256a1cb303db454c3faa73fa6705c9a7ce126110615879047fbd579d2c813fba535
SHA51237463297b6e127dc2689f2b998b14042189baa26727ab1770fc482035b09df2cd3f349fb11038fabde84d0b4a5a07bfc6b5c619001ddc70c9c37c0aa87b3fe04
-
Filesize
284KB
-
Filesize
428KB
-
Filesize
284KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
1024KB
-
Filesize
428KB
-
Filesize
428KB