Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/08/2024, 18:00
General
-
Target
942617eaa577202cb3c3cf4ae46929e6_JaffaCakes118.exe
-
Size
212KB
-
MD5
942617eaa577202cb3c3cf4ae46929e6
-
SHA1
8fc4c63b24f8d37d4aeb2095aea34828ed162348
-
SHA256
1e5a2fd7a2ff296305600e51654c7b0dd7364584e5e9ffcd0ddb929a280aca24
-
SHA512
9a852c3c4dd85964e9d9c27234199ac6359af7aaa53df416b6d6f4a759ee7b845abb5506e969d04467dfe040f0e73c73c409340b7d66dd703e4a7a31ee9fb4af
-
SSDEEP
6144:H64VvSOAAAJiJQWwaEY+p55bV0f6RuI+7SqtoOPmEf/J0:H6AkAAcQWnEYEnbeXI+7SL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\942617eaa577202cb3c3cf4ae46929e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\942617eaa577202cb3c3cf4ae46929e6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Ojamea.exeC:\Windows\Ojamea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 5283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4020 -ip 40201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5942617eaa577202cb3c3cf4ae46929e6
SHA18fc4c63b24f8d37d4aeb2095aea34828ed162348
SHA2561e5a2fd7a2ff296305600e51654c7b0dd7364584e5e9ffcd0ddb929a280aca24
SHA5129a852c3c4dd85964e9d9c27234199ac6359af7aaa53df416b6d6f4a759ee7b845abb5506e969d04467dfe040f0e73c73c409340b7d66dd703e4a7a31ee9fb4af
-
Filesize
390B
MD5dbb608ee59f332eefaa37b052c65052d
SHA1e6be814320481475b08b026e05e04bd57f40d729
SHA256298c297b4baa6556bf3cef2275988d7908e891050b51736764c2f1e98d774bd1
SHA512d08d56df3ff7d830354495332133ff94dbe355b6f727fdb8c9ee5df5656933ea3db72c4c2c7e8cfe4ac8c9de4d8b1b5e89ee7bedbcc85ebe37a6582d6e3aeb2b
-
Filesize
504KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
232KB