Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/08/2024, 18:39
General
-
Target
87353e83707ae9961599a4472bb8bc73_JaffaCakes118.exe
-
Size
857KB
-
MD5
87353e83707ae9961599a4472bb8bc73
-
SHA1
393fcd2a419d832021ce15ccf99466f57775b5cf
-
SHA256
b156300fe7c35a282f8bffbd5acffc5f62d0ccd064e5a32cdcfd3f2f39a70497
-
SHA512
0c842c9a4e7f2504a0de213bb87d72a9a1a8b4cb9e4a9b15c0e4f41f898ba7aa10f8ee74849bc55de6089d598907f4bcdffd6a902729f2bde95b6ac028ff4dcd
-
SSDEEP
24576:uc//////FqsVqMyLrr4cWRSvEPaVspeYmVnwO:uc//////YrNrrOCEi+/0r
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 31 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87353e83707ae9961599a4472bb8bc73_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\87353e83707ae9961599a4472bb8bc73_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\\·þÎñÆ÷״̬²éѯ.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\·þÎñÆ÷״̬²éѯ.exeC:\Users\Admin\AppData\Local\Temp\\·þÎñÆ÷״̬²éѯ.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\\Ë«¿ª²¹¶¡.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ë«¿ª²¹¶¡.exeC:\Users\Admin\AppData\Local\Temp\\Ë«¿ª²¹¶¡.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 3124⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1388 -ip 13881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f573924ecd5d1fe179d7d9e4265e4fde
SHA1bed0078cc3bfe61c6e358c7d8f8085e5a31f79e9
SHA25606355bc1c7aaf8be6338d305b8c36cc0c185e07e99a0cd27d1019c101c223ca8
SHA5123c16b57cbc9647ef566030fc221666aefb2c8dad9edc6440d3fd50e0fc92911668b18a9ad1e22edb014400a343eeecde312a1c9ef5b437fc3f5a88df3eede0d2
-
Filesize
2KB
MD506e1278fb000a48fffeea9869cc37cfb
SHA18bd8697a4a339139ab4ca13cf1155428fc7c53ab
SHA256f7f23f9d70110d73d03b25a82e6c97a3918aa695c6fe3ff94e593805f12e592d
SHA51231852b6c96de72ec561c1531737995139de49753c57863b7dd5155a7301b8bc15e4fe106e0a4e8fad8f10862e5a7caa7cccae43a70c2487bf23f26f7f220362f
-
Filesize
761KB
MD5ff30f22d2ad36ebd994b3d84341cfb0b
SHA15790d0cda75206fb0b285b2bc0852dc6486fc213
SHA25618203894f4ca3929deeca2dfd03116c64b40cb5b239e68879b931b71ff9f2157
SHA512fba0ce2af40327769f45cb8d2856d333db1b5dde595e4c71e2c16101a61fb7d8bfe8cf1d39f8d67c83da9e34fd80085ec5f1b7a097222045e95660a1c0a11555
-
Filesize
17KB
MD595c93370200a75aec0f41d79088323c3
SHA1c5f6eb49d5cd606c5c94120689c253a3436060b6
SHA25630493eb9174dd9f42baaee65ad3a1fbdb17485b3856fbfb49574cb6ef4eaef5a
SHA5124a5368a0b01cde5dd4869f7dca1abc7f1553a0fb08d8d3956d0089e1bc206d5a6590bedaef7d7e9e309f8de938e6f1899294fe5f71af7d9d28e9df4afde21082
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
884KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
1.1MB
-
Filesize
228KB
-
Filesize
1.1MB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
228KB
-
Filesize
1.1MB