Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
10/07/2024, 13:25
General
-
Target
34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exe
-
Size
282KB
-
MD5
34e6b3fad6a921ffadb25d0ba8df378d
-
SHA1
5584e0e3fc1cf43d64531d3ba38d1d4946e241a3
-
SHA256
339e017c578f19be12c702ae3315dfff2c38ff74b74edd0b67b1e128396a6b06
-
SHA512
6e7803c21f7d53b7958bcbc9f78d44fe5b7912887eb0be11b28b6941e2234edc55fb69921ef134147eca08c08dfe6f50c82680d0124213159a5b06691498ff6c
-
SSDEEP
6144:GEyI6bloxCv13SzG6EV0d/YrIE8MFNzG1PFIaDUtQ:2IcoMcEk6NFwtIaQQ
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\96AE2\95B97.exe%C:\Users\Admin\AppData\Roaming\96AE22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\34e6b3fad6a921ffadb25d0ba8df378d_JaffaCakes118.exe startC:\Program Files (x86)\E2E4E\lvvm.exe%C:\Program Files (x86)\E2E4E2⤵
-
-
C:\Program Files (x86)\LP\9779\1A44.tmp"C:\Program Files (x86)\LP\9779\1A44.tmp"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5c81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300B
MD5768c5e708868cf0dd1384f21b474f022
SHA1efc682d06b3e07bad0c91e4bb2c73aa0f7c06ad3
SHA25669059df85ad4a9d09128239dd34c2cb856d3220964445670c1f33b0c395ce853
SHA512822aa8704e7ba085193e7f84dd75f879b3c4c0b21cfe2dce392bcc28fa21bf555ddaf207621e6f2acfce4f223446c79f555da2c6d933dbf5369e2e27dcc77698
-
Filesize
1KB
MD5505a37ab0b48fbd8fbb5edd97c0dee68
SHA164da3a911a31abbdc68f422aa05ae3d71e38f04b
SHA2568d29563c86f3df6278967f93e25ff4dc95d217b9720e072ed2703324363c6a63
SHA512bdfb0c955481e5848dc4f82b8d206deeebc055bffb46d7e2e8cdc054154fe0ba85426a435b0345f7d537c7f9e02e826a2f7ede1270475a276092d5c5d7757d03
-
Filesize
1KB
MD5d447bcd26a52078b17b1aef3f6b191f9
SHA1fee71ac3b5e792e7ffe5a776bd85659f4ae32cf7
SHA256548c53601a9e2e6ac3b41c1b248cfba67a28c45fac029f61d23ffa78e9a2d781
SHA512140cf96317cc30a468e013b89c4eade8f0b8cedbc37ecefb04d2d08b8b9b3760a2a469ce3091e87c492b64ce30219b3ef06d02e402765175422268a8ffb9613c
-
Filesize
696B
MD5980a3041adfc5104d9fc0c0a58eb2398
SHA1889fd18c8a3d27efedc797615aa9960278576302
SHA25675ad3350f2b32e2298100d7d68f0a5a4b1e45b7dbbbe59c446b22ea3b9d99887
SHA512546c2eb19771ec82646ac09024648b002e58bc37d173759793bf87f2eaad82758badb2bec9183d2959b86e2a093655d079a86517fc98d2b2b78e14195f1bd782
-
Filesize
99KB
MD58512e7236d6f175a95604ed7d843b20a
SHA17f35c53dce0af6129bca3d199a84235df9bd6ef4
SHA2561cd98423b66062336bd5d06de36b0747482abeb4e526a9719d3d659bc3fc0edd
SHA5122031122102d22b834d33eecfb123f422bab250222774f2d2ce1f2d3e9df87a27202979f0cbf42592d92c5c164a133b56272202da1a61d3a84549ddb32fd70542
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
112KB