Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 05:24
General
-
Target
664d59e6abd751b006cf2df0e32600a4_JaffaCakes118.exe
-
Size
617KB
-
MD5
664d59e6abd751b006cf2df0e32600a4
-
SHA1
755f1163a7568f2bba4e397392c87ba480848deb
-
SHA256
a2d08018d13895342890f096ff1e072694910b8bedbef9e8b2463463599b4959
-
SHA512
089671de1bc60c980ea9ad43b8d066d2a3691e9ee396d185fe4fa4ae03cc844f77fd2fb8c7727127bd741b42f447bc6e04aa72adf3e2da70d28e83d919a72fb6
-
SSDEEP
6144:iiToL+5dbM74wLeQs6LpjzBWVDp6WqRQEB417STvM01XM/k9o+gluwtDQE/xGcQF:3ejlQwfNK55tSno
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\664d59e6abd751b006cf2df0e32600a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\664d59e6abd751b006cf2df0e32600a4_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Qjyqaa.exeC:\Windows\Qjyqaa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 8243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4112 -ip 41121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
617KB
MD5664d59e6abd751b006cf2df0e32600a4
SHA1755f1163a7568f2bba4e397392c87ba480848deb
SHA256a2d08018d13895342890f096ff1e072694910b8bedbef9e8b2463463599b4959
SHA512089671de1bc60c980ea9ad43b8d066d2a3691e9ee396d185fe4fa4ae03cc844f77fd2fb8c7727127bd741b42f447bc6e04aa72adf3e2da70d28e83d919a72fb6
-
Filesize
390B
MD514127afaa9f5c37616bcfc9cd1efd506
SHA1fdbc78faf296fa1a5276e56cedd1d3bc7b1e03b9
SHA2564d98ecf51ff3a5351bd772ac4b6a06373b4f68638351e5c9a68e568c6a5f6355
SHA512769769b203ae3ea78de0dbd36bba1072d6164a509858325960e53fcfcfe797f069e5c4ac930eae664f40e1905c0dd25ab432517d4b64c9ca4219c9e294cea3a5
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
624KB
-
Filesize
232KB