Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/08/2024, 06:48
General
-
Target
a5c91d65d6c76e0f8fe21d262d940f52_JaffaCakes118.exe
-
Size
372KB
-
MD5
a5c91d65d6c76e0f8fe21d262d940f52
-
SHA1
ebbaf05efd3ddc8d2a1e85f7478d0c4c8fc60050
-
SHA256
55b4f9384832de94426997cc9ca33224c3fe166c99e794cfd27ad28e66ef0968
-
SHA512
58da5b39d61ed01c568a63f424a5c197fda3ad5a2c0ac9ce9c9078bfc0fc3b9aa85c94964b9f0ce8052b437c71498f2e60b21d0958bacd35e71670ca960fe22d
-
SSDEEP
6144:1maX/nHXNucvhfI7bnBSNw9tJGkq7NNdQ249zDc/EhmIpJuBGoS:Ii/9vJebN9tgl7NN3UxYITu0oS
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5c91d65d6c76e0f8fe21d262d940f52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a5c91d65d6c76e0f8fe21d262d940f52_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jP01804OiKpD01804\jP01804OiKpD01804.exe"C:\ProgramData\jP01804OiKpD01804\jP01804OiKpD01804.exe" "C:\Users\Admin\AppData\Local\Temp\a5c91d65d6c76e0f8fe21d262d940f52_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5f7935706437e5122f52ddba99686f072
SHA163e739e40144378d51111030bfff80b6ca71290c
SHA256d428b71d8bad6155766e3496257d00aa75b50225e51c75b7db52bcf50f8b43b2
SHA5122d95b05757fcb40ab95e27cd11052682d087379d8c826dba272e98b9a7831aad84e927700287f2d68ff6c329d341915e8d33f344cf1697f6abbfc6425d613c3a
-
Filesize
372KB
MD5ed44b6ad12c7a0cb3a5d3d447f635ce8
SHA1700fe767c00e655a2fa3eaab19a178ac9998c0c5
SHA2561a60de6baf0c5432019bb0596e550a6c9751ca0f18bdbaef50c77dcb6e9a97e2
SHA512c7a2a7611f075041f7b345d52ccb6fb6c2cea218b051a6da5f706ba9e1f5d124ef3991c506180092030807ac355509e0789bdc9c5f63f2235b37425ecf3f5f51
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
764KB
-
Filesize
820KB
-
Filesize
764KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
660KB
-
Filesize
332KB