Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
07/07/2024, 12:21 UTC
General
-
Target
29f8d6102eeae3c9864ee958081ce7ef_JaffaCakes118.exe
-
Size
384KB
-
MD5
29f8d6102eeae3c9864ee958081ce7ef
-
SHA1
2b463d285559fdbe61c213ae0254c5ce0a54ef73
-
SHA256
3c002ac95b57e2a7597b4fda5b82a317bb5f60d66dbcb06b0b6d290e34306c6d
-
SHA512
5d55b23ccaad544605002202ff6ac16ed85aa8aaad929b4c72e938b9ca7f7dd969dbf340fb0afaaa9218bb966063c2e98961963f4ba670a427ef4f7f6c1796ac
-
SSDEEP
12288:R4/kOVG3MjYXrM08apXYT0zXAspwGD6pq2p:R4/XG3Mj6pIT0l2GD65
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29f8d6102eeae3c9864ee958081ce7ef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29f8d6102eeae3c9864ee958081ce7ef_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6AEB00014973000BD86DB4EB2331\043A6AEB00014973000BD86DB4EB2331.exe"C:\ProgramData\043A6AEB00014973000BD86DB4EB2331\043A6AEB00014973000BD86DB4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\29f8d6102eeae3c9864ee958081ce7ef_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
- No results found
-
178.162.132.113:80 -
178.162.132.113:80
-
178.162.132.113:80
-
178.162.132.113:80
-
78.159.105.142:80 -
78.159.105.142:80
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328B
MD523f5309ce3857892fbcba42c7d9ca1de
SHA1c45c729ae006292701a59382bf5b936543f43bce
SHA25656529e6f6bf3dbe5febbd6f0679c96682ce41a2bc6db237a3233b16887e7096c
SHA512a5c5048c3da2875808a3041184be8bc1f5c0e29c9ed7d244226daf4db59716ce65336e460bcd10532355153bc02179873bd03684f9cbbce7fea265e6838c1d07
-
Filesize
384KB
MD529f8d6102eeae3c9864ee958081ce7ef
SHA12b463d285559fdbe61c213ae0254c5ce0a54ef73
SHA2563c002ac95b57e2a7597b4fda5b82a317bb5f60d66dbcb06b0b6d290e34306c6d
SHA5125d55b23ccaad544605002202ff6ac16ed85aa8aaad929b4c72e938b9ca7f7dd969dbf340fb0afaaa9218bb966063c2e98961963f4ba670a427ef4f7f6c1796ac
-
Filesize
928KB
-
Filesize
780KB
-
Filesize
928KB
-
Filesize
780KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
780KB
-
Filesize
928KB
-
Filesize
780KB
-
Filesize
928KB
-
Filesize
340KB
-
Filesize
328KB
-
Filesize
780KB