Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16/08/2024, 23:47 UTC
General
-
Target
a06a6b80bac583222a264682c2dbbdf5_JaffaCakes118.exe
-
Size
436KB
-
MD5
a06a6b80bac583222a264682c2dbbdf5
-
SHA1
91ddf78ba59af9782341332869c6fc3593388086
-
SHA256
75f09e6ba39b55b535e154013ad99f6aa2273a25c683472da6f905746ee19946
-
SHA512
ad371634658e2f57e917c663239f1ac273688cf56c6d8662b3531dd8503d25731bde9de013e89724ea6f9f7f26281125d8f660bea1f79c5348986b2ad30709df
-
SSDEEP
12288:Ens+F4z37Izai0czeCEUWueejYtSoed3h:r+F477Q1Tz1E9uvGSJ
Malware Config
Signatures
-
Windows security bypass 2 TTPs 10 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06a6b80bac583222a264682c2dbbdf5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a06a6b80bac583222a264682c2dbbdf5_JaffaCakes118.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6A5B00014973000BEA52B4EB2331\043A6A5B00014973000BEA52B4EB2331.exe"C:\ProgramData\043A6A5B00014973000BEA52B4EB2331\043A6A5B00014973000BEA52B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\a06a6b80bac583222a264682c2dbbdf5_JaffaCakes118.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
- No results found
-
178.162.132.116:80 -
122.224.18.199:80 -
178.162.132.116:80
-
122.224.18.199:80
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5a06a6b80bac583222a264682c2dbbdf5
SHA191ddf78ba59af9782341332869c6fc3593388086
SHA25675f09e6ba39b55b535e154013ad99f6aa2273a25c683472da6f905746ee19946
SHA512ad371634658e2f57e917c663239f1ac273688cf56c6d8662b3531dd8503d25731bde9de013e89724ea6f9f7f26281125d8f660bea1f79c5348986b2ad30709df
-
Filesize
1020KB
-
Filesize
4KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
1020KB