Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe
-
Size
8.4MB
-
MD5
a53dd3969411ff771909c8aaf4fc2cf2
-
SHA1
4ce8babfef30063f20956f80287fb1d498af2867
-
SHA256
6ead7874a2e388bd9209379a90c7fb0da894ac2963d8ab09740858f4e5cb5d57
-
SHA512
827b39b5c61330b7a2bdee857dc5fe97215dab710317538b01b6c3ce782d7d3df0c6dd17dc6a57480a865f05da980f604a4921b18d74b1029341ff4f54994013
-
SSDEEP
196608:FznLVzHsHkFo1YMugLoqsjQfzqJsuAqt0g4rx4aW1vI4CqI:JLVQEFo2Mut6zqGPcqrSb1MqI
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000c000000016d28-2.dat acprotect -
Loads dropped DLL 3 IoCs
pid Process 2292 a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe 2292 a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe 2292 a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2292 a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2292 a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a53dd3969411ff771909c8aaf4fc2cf2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
613B
MD50f672c3f6b2a8555dbe91bc265d55781
SHA193b5d524339d03a05016312fabeb911f2a3eeb51
SHA2563003a079d5460879e15c58b0037ec9313752981f2049603df944cc6a26e345b3
SHA5124c6599507e40cdf2b3a4fb9f781b2d66944cbd4e5434c793050a20061a6ed050ea8475b3d247d5f4f2d8984f20241621db4c307a437df78775ecb46889df9f12
-
Filesize
652B
MD5bbc92b7e256015601754f7ad13cbc98e
SHA1ca0d6b2cec768f3aa8a74f8170ebb193fc0d47f8
SHA256476676a4fd9d70d50ce5350b9e255118364efc8ce2bc4f2bf74d5e47a8427e46
SHA512af586c5df2fdfff0e1acb45212d92cb97ee3eb2624617765e58d20effb85d7f18ac87553c42f240190865fb9638d9f5b8104621b799220729bbb333d341cfa48
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf