Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
25/07/2024, 23:12
General
-
Target
71a363266c105f319f8168d39fa1da9a_JaffaCakes118.exe
-
Size
364KB
-
MD5
71a363266c105f319f8168d39fa1da9a
-
SHA1
3a3dccb72b728bbf5960503edee357938f27a66a
-
SHA256
3b6eef211b6c9dcd82016e0a98663629aa9084731e9d911ddb735183b48d2144
-
SHA512
db307c2a2151d34ddbddc7550bdde1ad18ac96009eac3a5e3d996b727776eb34e37a3dd920207cb54a24a840a112760b98f10c4d483223a142418be2936a2aa0
-
SSDEEP
6144:HBMTvQEYBpy8wLY/5fxpKfS7YURZlO52/DxSVeHSl8dXnll1:hrpSOzOEBE2/DIohpll
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71a363266c105f319f8168d39fa1da9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71a363266c105f319f8168d39fa1da9a_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\71a363266c105f319f8168d39fa1da9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71a363266c105f319f8168d39fa1da9a_JaffaCakes118.exe" BOMBARDAMAXIMUM2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD50afec7949c3211bfff5114a92977862e
SHA1b8a84508a1bc340b8689bf61ec63ecb03b44a247
SHA256e980882bbf0f85c45d81443a8e91907aca46a588d807b45f09baa43621ffcc70
SHA512f89474a695b1a8c9dcae13db6d7b88cac3d92df219366073eac6de859e1a70e88729b48cf8960b5a1f8afad17a3f3c45ea06b897401bd2b8296bc016fab1a14b
-
Filesize
192B
MD5524504d5488b3fa3e8d3406794f4f2b8
SHA1fd45838d9a792cb0d989ecd6eff95728189d368c
SHA256261a147020b4958fecd184bdad5d81ed5611fb2844d3929613a444f23a58d15f
SHA512528f1efa15e7130300170656d374abab6412a8dd4368ca0038e53492fcb91410ee6edf0afb52d3034905d5d01703f3e6de9e0fa58839701cfbffaed022282642
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB