Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
04/07/2024, 21:19
General
-
Target
263f946192e5fab0f8987b2078893539_JaffaCakes118.exe
-
Size
137KB
-
MD5
263f946192e5fab0f8987b2078893539
-
SHA1
d29413317cb4d69df4143f9bd57fb3e8a85381df
-
SHA256
9b1015c942360985925900f197f64a0310aed874ed3290b78f29da567b8ee707
-
SHA512
5f96bc5477d56263692c5848193e2f9dc14bcee75db352b117bd518d0dd315db3da33366cbd3809d134e645cfcfcde09cd0859ff88737e81cffb9e6be4debdcb
-
SSDEEP
3072:iYuwM0iyK1koxKcPjLEBOo+DT8wu35V2wmG0IOUrzluEEHSgw:i/70eZE40wupVrdrAEBg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\263f946192e5fab0f8987b2078893539_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\263f946192e5fab0f8987b2078893539_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Nkozoa.exeC:\Windows\Nkozoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5263f946192e5fab0f8987b2078893539
SHA1d29413317cb4d69df4143f9bd57fb3e8a85381df
SHA2569b1015c942360985925900f197f64a0310aed874ed3290b78f29da567b8ee707
SHA5125f96bc5477d56263692c5848193e2f9dc14bcee75db352b117bd518d0dd315db3da33366cbd3809d134e645cfcfcde09cd0859ff88737e81cffb9e6be4debdcb
-
Filesize
372B
MD54e2e108a0555c190604b6961c66f7d1d
SHA10ae2d9e59a2b3ac98141940319dabffdf78501fc
SHA25689158151a7e3ef967315d2996cf817ed4472d97a75be33b50abf99b1d4597d23
SHA51228bc60ebdd3568869362804edbb8d921303b895d67cfd698064aae3ad05a09c87e17110051374f90c1694f63ec55b15654d7f5cdf74383526fc90ab947799145
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB