Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/07/2024, 16:26
General
-
Target
270840e836204b40a73d02def6f4c56f_JaffaCakes118.exe
-
Size
795KB
-
MD5
270840e836204b40a73d02def6f4c56f
-
SHA1
b700cf3d987dd8ef75013696dbd515638abc06e3
-
SHA256
5643e6693519b9e54451e446dd319c1f8a52e045c9a24eb7b901b894d2d5d6f8
-
SHA512
87a9c380f4746f02d1d36ae33ccce9fab0a03503cf259ca8557c8761bbbd163e4999486e9e4918468fe1ee7c1bbbafa3cf6346a10254be50d5ce5010abb89184
-
SSDEEP
24576:xRM7VN/c99hAzj60BFueyeNWNR3kl/B9ifL3Tj1W3H:xRM7VRc9DAzjJFubeNeRk/B9ifj1w
Malware Config
Signatures
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\270840e836204b40a73d02def6f4c56f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\270840e836204b40a73d02def6f4c56f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
732KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
732KB