Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18/08/2024, 17:49
General
-
Target
a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe
-
Size
117KB
-
MD5
a79f2947edc9daf185253fdd3dee4f74
-
SHA1
75abfcd09f0076697f58ccd02f3ed22f2e501cee
-
SHA256
725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22
-
SHA512
c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4
-
SSDEEP
1536:uzpoGDl31C8f6SOvaLzX+aXGrj9KABF9SPRFHquxMJOjvSaABsDAwvpKbKQ7LGuS:if6SOozOaXGrjdSP9EaA0ByKQ7Oj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a79f2947edc9daf185253fdd3dee4f74_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Afymoa.exeC:\Windows\Afymoa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5a79f2947edc9daf185253fdd3dee4f74
SHA175abfcd09f0076697f58ccd02f3ed22f2e501cee
SHA256725f6f3f86f718c4c170d09c687b9aef6e7caaceadf67230e1065197e0c3cc22
SHA512c5d99453726dacd79ddbc1c57d67314aa1d68ac2d25990a576f5a3dfd1a65b2d163722450cbeb6097da6082269ec9828694a4fbc3a74d602344ccc045e2692a4
-
Filesize
390B
MD580ec751a70ee5b1b9a0db464dd033ee3
SHA1370a2a733787f8eef2592cc66b26cc6b87ef3ee7
SHA2564b54e0675a08b000dd43eb5b033427d9e2bae1e5a0361d4fa19358f52f570654
SHA512d6866e4acc4d09330cf2a0407490541897b344652c26e0c51491e14c43abb48a34f9c806895c27ab9bc68a065c293e85515857e94b8e917b629bb4f02276d2b6
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
260KB
-
Filesize
96KB