Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20/07/2024, 07:49
General
-
Target
5fa1e8b903222be7c74edce61dfa0435_JaffaCakes118.exe
-
Size
212KB
-
MD5
5fa1e8b903222be7c74edce61dfa0435
-
SHA1
0f4d80e03f5f17c6aa0880ea3c22edee48ee7298
-
SHA256
556a827f132cadd2d32f1f4d90b0a12e641b8124f70b79f6f8131ea0ea91f8b5
-
SHA512
590fa04022d0cbd85762ba1e5568c974674685b2c8d9337ebee2448a44bd66ea326844ab97c820cf087bf63ebfa70f1a8aa1ce53133190e060339eb029a76b71
-
SSDEEP
6144:h+LpzeANQVBXTBPgLKJDSTQL8jPY1SnKhrn3u4pu:h+LPNQVBFPgLKJDl2Y1SnKI4p
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa1e8b903222be7c74edce61dfa0435_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5fa1e8b903222be7c74edce61dfa0435_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Wkedua.exeC:\Windows\Wkedua.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5de98a48c5a9ae79f4f8a0062e2a1b0bc
SHA192dbd45572e76f2919ebbf74264c598616961561
SHA2563451dda323012d7013feee58615056519bec6b4718422bfb0265061caa2cd50d
SHA512a28921563f6751a8a388f6a3f6cc95c4a8a5da8a9e1e492df16326aee28ced321e10ff6941d9917b172597a9bd3fa79ff2e4a46cd589e41da96e87b9126d367d
-
Filesize
212KB
MD55fa1e8b903222be7c74edce61dfa0435
SHA10f4d80e03f5f17c6aa0880ea3c22edee48ee7298
SHA256556a827f132cadd2d32f1f4d90b0a12e641b8124f70b79f6f8131ea0ea91f8b5
SHA512590fa04022d0cbd85762ba1e5568c974674685b2c8d9337ebee2448a44bd66ea326844ab97c820cf087bf63ebfa70f1a8aa1ce53133190e060339eb029a76b71
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
504KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
232KB