Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23/08/2024, 18:59
General
-
Target
bcccec78cfc1a43e998fb318df2a3043_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
bcccec78cfc1a43e998fb318df2a3043
-
SHA1
7b2f07507da3191b5b6feabe82b2feca3a38bb37
-
SHA256
870489ab9d127826e36919978c7fd80ca85dffd955562e6e38b095234445082f
-
SHA512
18ba5362ea0bc605f6fe4629619d0848afeb22eb7424ace28285e8ac3e0ede172571e923ca9e8f3bf103ef235b452f0ae6952500150fff502b4ae213d5eddf4f
-
SSDEEP
24576:iFszWS5ZfmLljbzQnDB+7BssNW5oIrqQFWrVMwNOiBxouj9D3:iW0lDKDB+7BsQKqyWrVMwXqU1
Malware Config
Signatures
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcccec78cfc1a43e998fb318df2a3043_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bcccec78cfc1a43e998fb318df2a3043_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\msets.exe"C:\Users\Admin\AppData\Local\Temp\msets.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
762KB
MD50aeab8f910dda47a3aed6652f9a1cfdf
SHA15b8024fdb3e7187f8253f41f7be479356b655ab5
SHA256805a756c8dc926ad37d27282a3abb595fe6ca7e51354e956489944e9396fed65
SHA5129e3d7c30a23f04a05d4f52bfbd7832bbeaed37db2b236486953aa50d37642c11fc59938a46ecf8b9467f950d281ea5fc848ef70a4fb223698fcb9b06ba14b2b0
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB