Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
03/07/2024, 03:56 UTC
General
-
Target
20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe
-
Size
418KB
-
MD5
20fead844c31288d236d5dce100dfca6
-
SHA1
525afc9c9f9f2acbf85e80f51fe5057b5f94407a
-
SHA256
16b6315121e9fe0dc284594d3f153b5e68de432ce4655beb37a382c8531b3544
-
SHA512
2884c94a9c4f1c1b9ae382283d5a9bef154be7753f609c41ede4ac9f47f09b7ffd01ebc4379e9dc5f4bea5cd839a415be36784cb57d619ea110ae6d32e644a79
-
SSDEEP
6144:z1LDhBEUQ2G7E+udcoPv5n68ucAIRRNSoNbh9tjyqhDzyBkfTT9MQrFbF4mp:z1fhtQYh6VcASRNSUt9QifTT2QrP4
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe"C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe" BOMBARDAMAXIMUM2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe"C:\ProgramData\oNd21500aInLe21500\oNd21500aInLe21500.exe" "C:\Users\Admin\AppData\Local\Temp\20fead844c31288d236d5dce100dfca6_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
-
POSThttp://91.193.194.43/Remote address:91.193.194.43:80RequestPOST / HTTP/1.1
Accept: */*
Content-Type: application/octet-stream
Host: 91.193.194.43
Content-Length: 130
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 501 Not Implemented
Connection: Keep-Alive
Content-Length: 121
Date: Wed, 03 Jul 2024 03:55:59 GMT
Expires: 0
-
91.193.194.43:80http://91.193.194.43/http
HTTP Request
POST http://91.193.194.43/HTTP Response
501 -
69.50.195.76:80 -
69.50.195.76:80
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5499e14f205661e969f8372b8bf5e5997
SHA14a3da1b34144f3e9b7adebee7ec8c53a2bbf95f9
SHA25616f8fa0bf995b91e0fa7fe992f4e485a12086a8953d4298c1c8bd6d30434192b
SHA5129afa05a4dd2898cadb6e97e44416458d7938e90eebefd7419c02e7086256197f5ff6d99d185335e34df2bc67018e02b71eb65cd6b10a9cae3f4da0813061f479
-
Filesize
192B
MD587509bd223c757571f27aa3a9b49de71
SHA1596afa8d9a17cd37a02e0335793750eefc8ead8b
SHA2562734768e81fd03468a33026a702637e4d30e4d5298f8c18fbab9c97975669f5b
SHA512d0779bd2b00f2419d8d14715119f7fcd6f344fbbc6a74510ee9bc49a2ea205452c2e5de3c8a255b93b3dbfff874d3bcc20dd57e38e949f59932f3ce642538e82
-
Filesize
418KB
MD5b6969fd2f343f54f45ebcf90c18d6274
SHA1016a49b36c00324db8f322727450db5ab9c2cc95
SHA2567d4eaefb946ad1be9ecd5b997912f7c788b899d7505df2ee96cba0c9f7338f74
SHA512aea411165f79fd5323f97a50736d5d5862388c28a49e27043784ffcf95f2fbf1e25bc2f3b3f073e65f33ae31ba845bd1c014ee024d1374759fc107d938309317
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB