Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
24/08/2024, 04:27
General
-
Target
bde3ecd6f649cee3b7194e8c1599eaa0_JaffaCakes118.exe
-
Size
487KB
-
MD5
bde3ecd6f649cee3b7194e8c1599eaa0
-
SHA1
da2943dcd3e0ef11541b6279d6a24960637c7780
-
SHA256
3364f3a95e490c628061a6dd1563f793530c09355385b60e98ce612ec4ff9e65
-
SHA512
30e6179f76f32d94fc54072239cc5246d5ff5084ceca3675baaa5e7e2ad572dc3cf36ee6d7dc93fcdb630f0b6f34c4ac92e0b0cb452ad54d179785727f7005c3
-
SSDEEP
12288:sICIsF97Db9lh4IdqGo6hxS100veqHnHF4yLFi9oS:3CJP73h4IdqLOi00vDl42i
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde3ecd6f649cee3b7194e8c1599eaa0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bde3ecd6f649cee3b7194e8c1599eaa0_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bE28258FmBdH28258\bE28258FmBdH28258.exe"C:\ProgramData\bE28258FmBdH28258\bE28258FmBdH28258.exe" "C:\Users\Admin\AppData\Local\Temp\bde3ecd6f649cee3b7194e8c1599eaa0_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD50b87ea58a93c7978fe91a7d2c50d41dd
SHA1b70589a2891f3d3dcc83b8d800ea06e85c735dc2
SHA256342493273458a3ba1f49b31f9e194e4d9cff44ce1f7996867719a58d5edd00ee
SHA5128a4859d8d129be70ba6caaef6aab96cf6815117a36315a36361ebc2a49735bbc535d251ab19d3ba65a717a317f250cb9c2b48cbf529763a1e9cf9648ab9e2a17
-
Filesize
487KB
MD5ab68ffd72cb16e80bc76252a6439edc3
SHA1e8538a9cb74354b4c2c9792dab54d8fd83a2f132
SHA2562f081c7c176119387a0aee095129a1254b2d700b6d03b7be767d68ec4f76e99f
SHA51255210737b84191cc67d8a9975ee762b4fae46e403199391c1a8d3a6eb6907e834e64ef4b9fa7d236380a9900d5b57fb6b58c8d5dbe15c5bacb9039d7cea96fd0
-
Filesize
772KB
-
Filesize
836KB
-
Filesize
664KB
-
Filesize
332KB
-
Filesize
772KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB