Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/08/2024, 07:25
General
-
Target
a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118.exe
-
Size
3.6MB
-
MD5
a5e42233c487aeb5f4fdf707c3d7d0e2
-
SHA1
620605482c4d52766b9e0dce8c7af931ece2d2e0
-
SHA256
88431e76440b94fd1c0daa199e615374c180bc2934d4c663996245608a2abf45
-
SHA512
20d0ad0b07397d8b801e971687c52374643283e9cf533b0d477546aa35441c744bd41a833ccbfb139773cc0cc296b59c536d605baa4e740b15668bfe189db951
-
SSDEEP
49152:MIG5HOL2c1XiVLMIifICpAaZPLfjmHs/zvj6Mzg1SpPCSSDfNjYSqWLBBRwIcCZ:MXH/6SVyICKqJj9zg1iKVj3qIg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5e42233c487aeb5f4fdf707c3d7d0e2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\alo\SmartGeardkwheqwvvjwt.exeC:\ProgramData\alo\SmartGeardkwheqwvvjwt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5a5e42233c487aeb5f4fdf707c3d7d0e2
SHA1620605482c4d52766b9e0dce8c7af931ece2d2e0
SHA25688431e76440b94fd1c0daa199e615374c180bc2934d4c663996245608a2abf45
SHA51220d0ad0b07397d8b801e971687c52374643283e9cf533b0d477546aa35441c744bd41a833ccbfb139773cc0cc296b59c536d605baa4e740b15668bfe189db951
-
Filesize
79KB
MD56228ea815e3806c7471d873fdeb429ee
SHA1db03867ab0a46b08f8ebe499c3dc0625104f8e8b
SHA25667aeec0ecbcec1bf7d6e6daac397b838a437c1c943fd6f0d7d2678d6c402a702
SHA51221de112f8090fd1b4d7500d3328cea282f3af81b4c8f7031c31b7f6f26d7e9d94020cf76115515065751bc0c7200b9f816763f22eac5e8c6794b169dee90e410
-
Filesize
1.5MB
MD56e1fecbcd1ed9c1eb803ab9ce0a8775c
SHA113ecd201aeabf870ca10db56f78c3e43fcea2ebd
SHA256b1eafa8c3511273afaed9abac8296559d545f17372b7d649043dea9cf3aae8c4
SHA512a8c1d08dd66f3fe428401b33d49a5df059ef2f67ac661fe9c6ab05289ed8bcadbcaa4cd5595c6e08e37028edaaf3c86bea0ce41735888d19292901f278da5fe4
-
Filesize
5.0MB
-
Filesize
1.9MB
-
Filesize
4.8MB
-
Filesize
5.0MB
-
Filesize
4.8MB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
64KB
-
Filesize
5.0MB
-
Filesize
1.9MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
1.9MB
-
Filesize
256KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.9MB