Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06/07/2024, 15:55
General
-
Target
28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe
-
Size
344KB
-
MD5
28bc1957a358ee387f38a9ab87c9406f
-
SHA1
243a4444f83fbf612811209d49c3c31be440c4bf
-
SHA256
a07f59f98713dac3d1fca666589763e9408d9ddf559e642682fbde2873f7c953
-
SHA512
454b593389cc6cbd5e64a1693de48de6267011fce1824557764b9f521f09f98bd560e4948932722e4903e7ec2a4d63057be15e6136c360253bc3aeba7b98d288
-
SSDEEP
6144:a8u1ZcjmBY+Msn4A6ne9OV8GPSkFFVc+5Ny84mSK/srm9Le/FXn:WcjG7fWeUV8ex664kKYLun
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28bc1957a358ee387f38a9ab87c9406f_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~3\UmEzI970vMFh.exeC:\PROGRA~3\UmEzI970vMFh.exe2⤵
- Manipulates Digital Signatures
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4552,i,15168044379859864039,3380316340477469860,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
280KB
-
Filesize
4.2MB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
860KB
-
Filesize
804KB