Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26/07/2024, 17:47
General
-
Target
75157c8ac87a38c5253d0e62ca8c47d8_JaffaCakes118.exe
-
Size
378KB
-
MD5
75157c8ac87a38c5253d0e62ca8c47d8
-
SHA1
6781ac9f6926e4c30ca2c8eb07d421bb7830bfc2
-
SHA256
2c7c5c952c34474f119b93bb4f8268866219dcbf440a64936e545c472c298079
-
SHA512
300424d09e10fae2bda3decb8bf9a5f7e6c96a8c3312bca1db9bf1cfdd3eb190d33799e124521676e9f30205006450860cfed84ca430609635e1d7ca9c0f1b67
-
SSDEEP
6144:xqdKIBSG5Zv1Lad/+LySSRdzwpxROwyKkEisE+3WkffAn1MUvAdL3d1NxgUOpljT:xIKIUEcZnSbROJKkUWkc7vAdL3bsp
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75157c8ac87a38c5253d0e62ca8c47d8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75157c8ac87a38c5253d0e62ca8c47d8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6A5B00014973000ABB91B4EB2331\043A6A5B00014973000ABB91B4EB2331.exe"C:\ProgramData\043A6A5B00014973000ABB91B4EB2331\043A6A5B00014973000ABB91B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\75157c8ac87a38c5253d0e62ca8c47d8_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328B
MD58597e89109c6beb5a1e47d663e1b0b9a
SHA166387b430863d2c5414d80adf21d1665fc31fb3d
SHA256f1b09c9f953a304f6bcb4dd04d60caf58c0dd20992742476695fa6785232a470
SHA512bf04e0321162f2e691c7b538554f3b9b50569ed5d3fd53a38dd083189459dfc094a1a770f8d4eb968dd65a73423bd190bc497cbd7fa57be0fc09011949c5cd08
-
Filesize
342B
MD5081bf130f66f32bf001f558a114c3737
SHA164ac3e1498abdb6c3d4cbe23fb33c23eb2394f72
SHA2567f39449c8f0ee6c21cbe7b4b3ddffa55c4cb00834fbb00780e788085eb6bce2b
SHA512648951b915471c5a6c3071796be0bf190a152dcdb1db554fdaa471e7fb3d7e26ed08f5fb60f4ed7dd61cf7a4b9ad0e764f68b99c211879ed23d646a4a16a5ec6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
378KB
MD575157c8ac87a38c5253d0e62ca8c47d8
SHA16781ac9f6926e4c30ca2c8eb07d421bb7830bfc2
SHA2562c7c5c952c34474f119b93bb4f8268866219dcbf440a64936e545c472c298079
SHA512300424d09e10fae2bda3decb8bf9a5f7e6c96a8c3312bca1db9bf1cfdd3eb190d33799e124521676e9f30205006450860cfed84ca430609635e1d7ca9c0f1b67
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
780KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
808KB
-
Filesize
780KB
-
Filesize
328KB
-
Filesize
808KB
-
Filesize
328KB