Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
85s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
14/08/2024, 10:55
Errors
General
-
Target
95cd8a4e9a5ee01a279ca8bd7543c441_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
95cd8a4e9a5ee01a279ca8bd7543c441
-
SHA1
8eb50da7d6272940f1f024176c718a63758571bf
-
SHA256
479fbfe6c4f9aec101b4d43bf7584342ec5a26ea79154d08b0eb9fc3ec67663c
-
SHA512
182045368f6b8c2f9b6f0faca6999c42c0440cadcbe5abe3cfd20a3a22ac1b43a52a5878a2d651f31969fa0e5566810b8763844fcff585efb0b84e79e4e10131
-
SSDEEP
24576:sDTbM9Lz6497L3li89RwporXjQSk64Dc:ETQ9f6I7LlBLQSkHD
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cd8a4e9a5ee01a279ca8bd7543c441_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95cd8a4e9a5ee01a279ca8bd7543c441_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\qaBhMN5DK0F3.pspro"C:\ProgramData\qaBhMN5DK0F3.pspro" --run --delete "C:\Users\Admin\AppData\Local\Temp\95cd8a4e9a5ee01a279ca8bd7543c441_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD595cd8a4e9a5ee01a279ca8bd7543c441
SHA18eb50da7d6272940f1f024176c718a63758571bf
SHA256479fbfe6c4f9aec101b4d43bf7584342ec5a26ea79154d08b0eb9fc3ec67663c
SHA512182045368f6b8c2f9b6f0faca6999c42c0440cadcbe5abe3cfd20a3a22ac1b43a52a5878a2d651f31969fa0e5566810b8763844fcff585efb0b84e79e4e10131
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB