Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26/07/2024, 18:43
General
-
Target
75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe
-
Size
279KB
-
MD5
75436abd2b41ab1c5b9fb6ac88b472da
-
SHA1
7da5d9857ee5838915a2cc9a22d8ceb6308d8840
-
SHA256
df850b1fdfebe1f42d363cf0347a5c5f246803a3e41a5bdd540d69434a47ad81
-
SHA512
eb4deb40daa5acbd4a1131974596c5b4bfec5416562713bc9af7b3df7e64b7a1b99308d71187004251414ced1691c80e81020ca38b89a9e9272b352f977a0221
-
SSDEEP
6144:zR0QIR7HRQbcbj03j5h3HVkw9yxDpkI9VqF6bmsdGnX:z63j03j5Qw9yBpvqF6aIGX
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 19 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\5F9E4\1AED3.exe%C:\Users\Admin\AppData\Roaming\5F9E42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\75436abd2b41ab1c5b9fb6ac88b472da_JaffaCakes118.exe startC:\Program Files (x86)\E495B\lvvm.exe%C:\Program Files (x86)\E495B2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\D3A5\9AE8.tmp"C:\Program Files (x86)\LP\D3A5\9AE8.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55d5c60a88239ee4f5e54174668207224
SHA13c8ae337fd50aa0d5821f1570c4c1fd7b972c0c6
SHA256e719440f8bfb1e4090bff6b9d4eb5b11c5dbd275c836ebe16ddcf1eee1cfeb1d
SHA512ad0006c3efd0410789754ccba8aaaf82f361ef4f7b24bd3f8565e80666ae9a836dfd70e298614b7b99c4e2e57ced6afc27b70c1c7eda99d97720782dfb016233
-
Filesize
1KB
MD55ca449dc56279a79c2bcc4c347c206c0
SHA1b27aeba3cac157766b8fe9538025769b73d9c98b
SHA256676be2e14ae7fae5bf12f0b24480d7d20aaee00184ce7a30286e520517a9430a
SHA5120ae56c98018a4176ac8966a23e792751e7af01f6c4a3c622ad22464e1b2f460d42441eb044fcab73f2f6c5415d96379529263f3da62ce4010a21d1703cb272cd
-
Filesize
600B
MD52322fe383b0395425e4f31df298c19ff
SHA1cbbc42ae2ca85b281f0babfdd446569dd3cdfff1
SHA2567fdb94b61d243ea69335a465ba2d5fda4b9cd5e34bc66458d20b376ed194e10f
SHA512c11ba8f3b63f2fcccefa2645220225fa30f094fab2954a3ecc190453c45c65349523b19fe7af99bd61341ac39312b980a45f76b76112703a532bf3c2763cdce9
-
Filesize
996B
MD51aac325ce50b5d736aea1fa64a7b9ad4
SHA1789cefcb3d154a2bb1e6f628a7b56f1edb619f45
SHA2560b14efc2cb20878b84f34f72f44719f1e656f51a335c1d83ae13af15a4c0eaff
SHA5124121cafdce68e7662f3d7e4fc304e3cdab8176bd89288f3bdd48cb6448795d655a7bcf4405f4ade84902df519ec11e64bc52a507f58c22d2bc472996cf7e2583
-
Filesize
98KB
MD5d80b9b537e9352a07cf0832971882498
SHA14f3c79ad91344b644ed160b843946712c9201282
SHA2562a6fa00fea45fa4c2947c1da516f8dbdc3b5c53b30e9d4f1b988edf254ddfa99
SHA5127c0f43ac9ae5d03784ce7968a935c891d255d6b6f601d1ee0b16c1f01e7b18926bb7d8b772a85eb58b9ac4331c73f241bc94c8293a9a12d81ba4bebe05e46190
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
284KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
112KB