Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
19/07/2024, 11:52
General
-
Target
5bd2ed97a6fe571b862ec34835549950_JaffaCakes118.exe
-
Size
400KB
-
MD5
5bd2ed97a6fe571b862ec34835549950
-
SHA1
a50f25b419381471b7fdddb4fc6675533487af52
-
SHA256
ba0217fbe8df2e8cd9c29caed0454c850b11a02528ffa6df0e658a700b2ec3b4
-
SHA512
0d41e4a5fff229d7ddbbde6a04c3869d2b66d957dd526cdd263e69b0846fb288f8247a1e1f980ea7d8d621d20e0f31483a4b9263b312c2c9f4b113c79fccf6a4
-
SSDEEP
6144:VaZL9Gi7BaOoeK/PQsC0F7B0SfkYKN6Kiefbz/j4SHfx1ssfdx70s:VA9Gi9aOvgQsCmSSfkNFc8fHRws
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd2ed97a6fe571b862ec34835549950_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5bd2ed97a6fe571b862ec34835549950_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nE42900KnKiG42900\nE42900KnKiG42900.exe"C:\ProgramData\nE42900KnKiG42900\nE42900KnKiG42900.exe" "C:\Users\Admin\AppData\Local\Temp\5bd2ed97a6fe571b862ec34835549950_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5f354db3cda9b2efe8d0ab09b3dd638e0
SHA10203449bd08594b6a12ba1c07c86060669bfcec2
SHA25624a325fbc88babfdcecde82d9b2f621cd315ef7f3682721b9769d3859ae66878
SHA5127bbabcf103ea4f4fdd57031da76524fff8c84834be01c6f4a2365cb7c4d12c924f5b1fcce63e250074d31231574ebbf58a9f525437254274b70ecba8dda16597
-
Filesize
400KB
MD598edbc0a2912a297e3bfff9d6c0340e6
SHA1045dcfab2507e31f51653bec736694d013f3df4f
SHA2569a322903fd1d7c6789d422a6d138f3f93df5e37cf23446512055dd2ecaccae94
SHA512617700613d0d7d6fdaf4067989ef2aefe98d4275e1155f5191cbadca59346a28002f6372e1000e18db8cde6801d33b9c375d4305fa2109b654def3459c0754af
-
Filesize
12KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB