Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 08:45
General
-
Target
490e2ff9d485fd68d1c439697b7567fb_JaffaCakes118.exe
-
Size
152KB
-
MD5
490e2ff9d485fd68d1c439697b7567fb
-
SHA1
8afdf999eb36fb49f23730133ac467a93e169a18
-
SHA256
85fc0e966a77d39b21c04b3a2b3179fd283606ad06c3a3776e9e1c9a6f862fbb
-
SHA512
dff3bfcae07ca91d3693fc87202e2a9a34ced614149c0ca019b013d8284318a7e860a44597829580e103d78cf460e3a6a6fa90a1ccff5f6ae5d675bad508b50b
-
SSDEEP
3072:h72DTjMbh1+u7jb2WLyYAfozPCO9Jk7Np8rNmxpmYCEoZx:F2vaDjb2vq+Bp8rNqpZCEob
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\490e2ff9d485fd68d1c439697b7567fb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\490e2ff9d485fd68d1c439697b7567fb_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\winword.exe"C:\Program Files\Microsoft Office\Root\Office16\winword.exe"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 7562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4092 -ip 40921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
1KB
MD5cd830c5e38f464288ef7a69037c99892
SHA109b8e8d6923b7a4c91af65cd825f1053ca7ad7cf
SHA25660738f9d1a767edbd5bf84c6c8bacdfd061c1f25014e6fd619cc9ef121172407
SHA5129177c45962befd04571d4dfdd18e52c87c853b9ebcb30e6ccf22a0571886de4924fd2faf64393c245eb66b60756542a54503dab3369d464acaaf7dccaa0b02ab
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
151KB
MD58ca8d2f99536112a8060854f8d65480c
SHA18d06abc3a709d51e19ab12261c8360c1575a58e0
SHA25618c86da2845bc943caead2d7613f6b080997a51816bf0b94360f30fd4bc9140f
SHA512821a94ce290b861d6eb6b84319da9447fceeefb2425590ccd24b5a1a091abec6939d21808d77867573a41fd20f50e452cd7dcf8b3c9ebcdb17b85e4f89051332
-
Filesize
152KB
MD5cc195bd4f7129ef082b48b8cfd33b29c
SHA142ef1745012ed91c0e5855609503d4561e67163a
SHA25612a37876c9c1feb1d89aebb7819868b5e3e25c79787008296fe6809038efdfd3
SHA51245ea1689ee3d508aaf7cd9939b1e4c6387fe8b3edfa5bfc6875030610900f8053d0605057ed2a6d35bc3b414c7eb59a633d5ecb82c944fec56cad237316a1ec3
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
92KB
-
Filesize
92KB