Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
14/07/2024, 10:25
General
-
Target
45695329649f94b72b296d683939fccc_JaffaCakes118.exe
-
Size
197KB
-
MD5
45695329649f94b72b296d683939fccc
-
SHA1
1abaecdae58a4ef4812e5a58cc9f9a8adc2d088a
-
SHA256
24b5d2d5fe7c1fcbb93b2a28001b02297287beb39bdeb90dcc3e3900dc21277b
-
SHA512
c3cb8ff45ac86f9e7ccee992ada46af2b5358c93eb97c7c67f8d9d0de353a219dea33bd3243198ba1b46e5d2f519b0b53a237a52d8ab19f2af8b0c6ded54fe43
-
SSDEEP
3072:UF2SRGOYiDEah5u2606Tqa4esT/TCJCKEOcP5/9iIttyB2BSz:UF22ojRnqa3DkvOIiwR0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45695329649f94b72b296d683939fccc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45695329649f94b72b296d683939fccc_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Rmejea.exeC:\Windows\Rmejea.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD545695329649f94b72b296d683939fccc
SHA11abaecdae58a4ef4812e5a58cc9f9a8adc2d088a
SHA25624b5d2d5fe7c1fcbb93b2a28001b02297287beb39bdeb90dcc3e3900dc21277b
SHA512c3cb8ff45ac86f9e7ccee992ada46af2b5358c93eb97c7c67f8d9d0de353a219dea33bd3243198ba1b46e5d2f519b0b53a237a52d8ab19f2af8b0c6ded54fe43
-
Filesize
372B
MD53b15f899225dc9af9f6182ad62157d28
SHA1dbd20f0f40679461603c928ca5b1b66ee1ff9afd
SHA256b5de190647313140e841674619fe6e833049009f5a24ded611113acf18355196
SHA512d6a560681b0c23732f55af7060ba170ad3fb1650aa6f4796855c733d377c6e574ca4250119fddd88aa51931bafe427cb8b6768719055c4de79ae095946c523f0
-
Filesize
232KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
432KB
-
Filesize
232KB
-
Filesize
232KB