Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
10/07/2024, 12:46
General
-
Target
34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe
-
Size
448KB
-
MD5
34c80baa4305387eb70ae9aba0da833e
-
SHA1
065a6b67ca3b0c035edfe943459df9381f28e1d7
-
SHA256
269ee548ec13e1973b361783869a7168d6ea8e9866d217aecc89644fcf3b9474
-
SHA512
a0ebf50ddae69aa1679a1f89099c3224f13298a176b388a70172db821cd60f68be2b68444964ec262e8fe18c34892137b353768e40fe51e849d0e4b77c67cea8
-
SSDEEP
12288:/zOFZykd4pU9AUV6EQhrfV+Fu6Q+0MC3VTJKc4:bkR6pU6UQEgrf//yANKD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\oB28601JaHaL28601\oB28601JaHaL28601.exe"C:\ProgramData\oB28601JaHaL28601\oB28601JaHaL28601.exe" "C:\Users\Admin\AppData\Local\Temp\34c80baa4305387eb70ae9aba0da833e_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5dd2ddc6c520a58b4c702c9b1beff7b54
SHA1fa57940bee2c620cdd1045fee71fe50a0a73842d
SHA256cc375688701e79eb68b5799af7fc9637129085d271764776a9b10c3c69e13605
SHA512bcaaadaefbbcbe27182169f1d420f02d5dbbe1f268d000e8aea207902c140d0ebaf87fdf68c75a7e972a8719864b815b94f5a409d3db25790df10e40053d8227
-
Filesize
448KB
MD5d9f98f4f209db0608e00cb53e8a7031c
SHA13b43e34292f4f41d782cc905dc92f9b9037269c8
SHA256477531e8cb2bf75d61c33896fb887e778f9b842d931da16cc21f83572313db71
SHA51224e5a2b33f01ebd078c2623474e9d10b14191bad8b23fa2db34238d2f45dbbd8c8f801b10ef5625220ee1cb8bbbb292766a8a51bf064f2c9959afca1962bad75
-
Filesize
8KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB