Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13/07/2024, 20:33
General
-
Target
433cea8bc34cece132c891010bf96ef7_JaffaCakes118.exe
-
Size
212KB
-
MD5
433cea8bc34cece132c891010bf96ef7
-
SHA1
f516fa0e92de8cab74d9a24bb37bfab991ed4dd2
-
SHA256
f0549dc5ffc5d89866f700a3c53d2dcac948c6149fe96d56129cf9e0fc5b8c85
-
SHA512
d2053334ecf49c897485152a5ab799a68e7ea7e34b9299742ad936ad44c0b0e03228b2cabf55f58a80d63ef9d5769155055cc0101c90262d1658707437ef35cd
-
SSDEEP
6144:jAEkK6rmEnOwO6esxm1XwY7XEjZufoKEy:8T3rnOwO8xm1XPX8qwy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\433cea8bc34cece132c891010bf96ef7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\433cea8bc34cece132c891010bf96ef7_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Uhelya.exeC:\Windows\Uhelya.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5875d930bf256af0ae6be4bd818408086
SHA14b76800d8b32678ce90fe05dff0ef78b0ce08825
SHA2560c01e4faef7aa5afc02dce3e8feff9a5048784b6bbf6734985274cec9faf9752
SHA512a0825dd338c1186b47be8adbcb3707075315ba5d769e9bfee8c023e9befa475d6ceab63a3ad41015c7a033afa2a7a180e41833893ff40e6b98d8fdf23bf98c3e
-
Filesize
212KB
MD5433cea8bc34cece132c891010bf96ef7
SHA1f516fa0e92de8cab74d9a24bb37bfab991ed4dd2
SHA256f0549dc5ffc5d89866f700a3c53d2dcac948c6149fe96d56129cf9e0fc5b8c85
SHA512d2053334ecf49c897485152a5ab799a68e7ea7e34b9299742ad936ad44c0b0e03228b2cabf55f58a80d63ef9d5769155055cc0101c90262d1658707437ef35cd
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
508KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
508KB