Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe
-
Size
258KB
-
MD5
6409cdb1297fd682d91873d15014d262
-
SHA1
eadbc07f7b0f5cb5945405113642771b543b2b2e
-
SHA256
150b22035d515428bcfedab647c7bf5e77434a2ce6c21112c38901d2e7dd5b58
-
SHA512
bdfb28195040cf684a06040eee305461bbb8e48b1d1f06ed0a1e79470ce6dc7e8a5cd9a96e93102ba9d1f462566f4367c0e2411f215d64f2dc483648e8136319
-
SSDEEP
6144:7wxRVX3qSs76cNqg9CRKNpFk2P/ykDI4vke:7qaSsVNq4CRKNpFBq4vke
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2672 Dreary Colony.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\UserWizard.job 6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6409cdb1297fd682d91873d15014d262_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
PID:2256
-
C:\Users\Admin\AppData\Roaming\Dreary Colony\Dreary Colony.exe"C:\Users\Admin\AppData\Roaming\Dreary Colony\Dreary Colony.exe"1⤵
- Executes dropped EXE
PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54d6dcf3b4297c7fb48add3505e95715c
SHA1c661667387858958884eaa980d7436fccb072e70
SHA25634e3e8bdc0918e9ac7d84e9b4534e76e65bd2f09bf7f4de40e1694ece2059702
SHA512c5d0e3fecad9a5d403bb369790d119e8a5f3aac394d71674ae23286cfb6e55be41e373229ecb62882f7a41be9d03f75cf9c8bbd011dbb7acc08f08f6a9b78b18