Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15/07/2024, 04:07 UTC
General
-
Target
4826e3d9a775d82209a1d3db23ae6b44_JaffaCakes118.exe
-
Size
352KB
-
MD5
4826e3d9a775d82209a1d3db23ae6b44
-
SHA1
7bcc1c46b20690b1f316ee64882340992efd80fb
-
SHA256
40dce9ca641144297bfe32cca4c147be4c725a55c3f7c2458ee5cc91bab15b70
-
SHA512
ad10fcd1611be1492abd39c2f731c1c48c27634e39941230a2f288cc0eaab570052eaa9da9a7e8239e4d7728c89a965d07aa6decad57ea0122ccfda822d50eee
-
SSDEEP
6144:JjttqWASxQ0rShyGlReFjbjfhyqQMRYNYoDvohAi3lFeB6M2Xf3:JWWDQcShyGloFjbTA1KmNo/VFC6l
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4826e3d9a775d82209a1d3db23ae6b44_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4826e3d9a775d82209a1d3db23ae6b44_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6AEB00014973000BD86DB4EB2331\043A6AEB00014973000BD86DB4EB2331.exe"C:\ProgramData\043A6AEB00014973000BD86DB4EB2331\043A6AEB00014973000BD86DB4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\4826e3d9a775d82209a1d3db23ae6b44_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
- No results found
-
95.168.172.86:80 -
95.168.172.86:80
-
95.168.172.86:80
-
95.168.172.86:80
-
178.162.132.113:80
-
178.162.132.113:80
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328B
MD54ebcc6438607b87c891b9cecdd8ec5c5
SHA14985e817fcd4207d132c2d503db6e0fbb81724a3
SHA256aa867a5bafb17c2f078a91171b475647a7750ece6016a815778c60f452a2a8b2
SHA512177c4c2f5dc99d9ab19054745b026e9a0d12f0de93f0d466134e595030d61cc52201a7f54dba98840b57eca8c4ee19ac85d3ac6e3096730a9fcdaa0ec35c8970
-
Filesize
352KB
MD54826e3d9a775d82209a1d3db23ae6b44
SHA17bcc1c46b20690b1f316ee64882340992efd80fb
SHA25640dce9ca641144297bfe32cca4c147be4c725a55c3f7c2458ee5cc91bab15b70
SHA512ad10fcd1611be1492abd39c2f731c1c48c27634e39941230a2f288cc0eaab570052eaa9da9a7e8239e4d7728c89a965d07aa6decad57ea0122ccfda822d50eee
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB