Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
13/08/2024, 18:00
General
-
Target
942617eaa577202cb3c3cf4ae46929e6_JaffaCakes118.exe
-
Size
212KB
-
MD5
942617eaa577202cb3c3cf4ae46929e6
-
SHA1
8fc4c63b24f8d37d4aeb2095aea34828ed162348
-
SHA256
1e5a2fd7a2ff296305600e51654c7b0dd7364584e5e9ffcd0ddb929a280aca24
-
SHA512
9a852c3c4dd85964e9d9c27234199ac6359af7aaa53df416b6d6f4a759ee7b845abb5506e969d04467dfe040f0e73c73c409340b7d66dd703e4a7a31ee9fb4af
-
SSDEEP
6144:H64VvSOAAAJiJQWwaEY+p55bV0f6RuI+7SqtoOPmEf/J0:H6AkAAcQWnEYEnbeXI+7SL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\942617eaa577202cb3c3cf4ae46929e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\942617eaa577202cb3c3cf4ae46929e6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Wsagoa.exeC:\Windows\Wsagoa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5b055f6eb63eb9c591224f43868e845ea
SHA12e80a5ad33ac03fbdc7b36746fb76be2b20b932c
SHA256bedacff112d302c33d52f0c1d432abee524e1a11b829d0d74927fcded4cfd319
SHA512d0a09b7afdfc926a6288e4b3cc846afd06346024a3ff74af42257f7f42a46ab3677cae47066cfc44d6bd82ad6fa587ee293fb030534a721917635d0b7a35b818
-
Filesize
212KB
MD5942617eaa577202cb3c3cf4ae46929e6
SHA18fc4c63b24f8d37d4aeb2095aea34828ed162348
SHA2561e5a2fd7a2ff296305600e51654c7b0dd7364584e5e9ffcd0ddb929a280aca24
SHA5129a852c3c4dd85964e9d9c27234199ac6359af7aaa53df416b6d6f4a759ee7b845abb5506e969d04467dfe040f0e73c73c409340b7d66dd703e4a7a31ee9fb4af
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
232KB