Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/08/2024, 09:04
General
-
Target
9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe
-
Size
463KB
-
MD5
9570dfb4575cc4a10791add62e64de24
-
SHA1
9ce4dfac5cd7a09114ea14817866d4ba3ac3073e
-
SHA256
0ac802d9bf8fc8365b4e018be3da13e1ec5f9fe4b57883c9d7875c64f9f354a5
-
SHA512
88c92d8059b92cab068d2a34bb3f3dd471f455cff14dfb6d776860c3fd4b8e5536694c5beebdcc8354f3f8158684b5402ce420dab5c7377d4c07fb0a92a3abcc
-
SSDEEP
12288:Zwax+LBZJT9Z99ljxPh0UsIF5DBIQ7GX74h:I9ZF9DfwrI/DBIQ7GXI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\aP28301JpEnP28301\aP28301JpEnP28301.exe"C:\ProgramData\aP28301JpEnP28301\aP28301JpEnP28301.exe" "C:\Users\Admin\AppData\Local\Temp\9570dfb4575cc4a10791add62e64de24_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
463KB
MD5b2947e4ab1fd932df378e94c16d77416
SHA1e7cbfa397e1cda98140f8026edc6deeb58410588
SHA256c2ef0baa75df835642fb88cd165e52ad81cff2d66899cdbe5018f9a28be29738
SHA5120c98faa2b44feb39af95c3a30b4cb41a8b58d61090da54c464052c6c228beb8004bbe6bdb8d5f3c2cae2a605fcba75b49c248552921c1b5dabf13154761e4a68
-
Filesize
772KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
772KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB