Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/07/2024, 19:04 UTC
General
-
Target
1c2702cfd4a2effd1b80c416913529d2_JaffaCakes118.exe
-
Size
170KB
-
MD5
1c2702cfd4a2effd1b80c416913529d2
-
SHA1
a779fdb5270ee57f820dd4212f992950f09907a3
-
SHA256
0c369fa4e5d433c3bbbcc83506fcbd15ac59de562ea647de9aa0ad51b1d8880a
-
SHA512
0b41b087d30a63d4ad9de1ffb44a8f4d57829626a6abcdfdb03810dcdd3aaf869526bd01357c75335e4797949046ba8a596c4e318cbe53d2f2166a723a825497
-
SSDEEP
3072:jt8XV6M5+9eWGConAb6X1jbkdnRmpwa9SeQvFFxGP8sTe51GLhxioutSy:RQ66SGCo59kdRla9pQtqRem7ioSv
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c2702cfd4a2effd1b80c416913529d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c2702cfd4a2effd1b80c416913529d2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1c2702cfd4a2effd1b80c416913529d2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\1c2702cfd4a2effd1b80c416913529d2_JaffaCakes118.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Recycle.Bin\B6232F3A651.exe"C:\Recycle.Bin\B6232F3A651.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Recycle.Bin\B6232F3A651.exeC:\Recycle.Bin\B6232F3A651.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3Jo4E6E.exe"C:\Users\Admin\AppData\Local\Temp\3Jo4E6E.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
Network
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A -
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN A
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN A
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN A
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN A
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
DNSallin2right4you.comRemote address:8.8.8.8:53Requestallin2right4you.comIN A
-
81.218.19.236:8080
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
-
8.8.8.8:53www.microsoft.comdns
DNS Request
www.microsoft.com
DNS Request
www.microsoft.com
DNS Request
www.microsoft.com
DNS Request
www.microsoft.com
DNS Request
www.microsoft.com
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
-
8.8.8.8:53allin2right4you.comdns
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
DNS Request
allin2right4you.com
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD581355bc35f20d20008335798e6be31dc
SHA12b76efcf01f13e7234582eba372f951ff48047f3
SHA256d62c7a42ad64884d596fdbd75e96af45e5e8c635efdc4650c570d19a05f7e6f2
SHA5125b77814570644e0c92d8ed6a72d5cccf099d30aec15c1598718b9724c71b9c5d6db92ab78733f8fa65c85d6affcc14af9cd92085f7ae166324671ae9d02c1630
-
Filesize
170KB
MD51c2702cfd4a2effd1b80c416913529d2
SHA1a779fdb5270ee57f820dd4212f992950f09907a3
SHA2560c369fa4e5d433c3bbbcc83506fcbd15ac59de562ea647de9aa0ad51b1d8880a
SHA5120b41b087d30a63d4ad9de1ffb44a8f4d57829626a6abcdfdb03810dcdd3aaf869526bd01357c75335e4797949046ba8a596c4e318cbe53d2f2166a723a825497
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
8KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
396KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
20KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
16KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
8KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
396KB