Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 12:31
General
-
Target
c0c010c2eb39759c02eb552bee42cc80_JaffaCakes118.exe
-
Size
157KB
-
MD5
c0c010c2eb39759c02eb552bee42cc80
-
SHA1
d08aa96bbba14c48d3bc82ab7cce2c1dc3d1c000
-
SHA256
a3726e072940d4b252f3c882b6a0900804d125c2f460d3a6e00a0ec725417242
-
SHA512
1c3a6298249af34d6277f4fcb109a89d05b53a9064789d16ae22585397b3768a1e40458b3857ebd262956a97fe3560a561a6ac0626fafa47355d8b1260254c6f
-
SSDEEP
3072:2+Q/Vy4mb1FQk6VKFQ+Ia0UdptDKCCygcOiWguJ9tDIdS:dQg4wZ9J06pRKCCy7Wgu7tiS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0c010c2eb39759c02eb552bee42cc80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0c010c2eb39759c02eb552bee42cc80_JaffaCakes118.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\winword.exe"C:\Program Files\Microsoft Office\Root\Office16\winword.exe"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 7282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 47121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
3KB
MD5d988e18be001a9134c6eee0e6d0c947e
SHA17e8c5ed7fa488864c4a27ed0a222972795f95f33
SHA256d40312d328b924e302a23fcb3f649760930ab1fe40d04eca238ac2a12f8882a7
SHA51266c126ea844052ae5f433f4b486d613b6e1454e1a020167f7f1bcb266cce2e030ed575cd95c52d190753c4d022545e6ba6c5effcd67ffc1ee65b1da80b41780f
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
157KB
MD52b93c097e208191584b1ea92c7858106
SHA16ee52a6cbeab6766c0bf4cfb6393835d1e0e8679
SHA256da294d978a7dd848788e67b1042d5ea6a9030da6da81b4a6593192fe329af327
SHA5124e4b1d416d2d32ccc7c5427fd558a216e86c672bd20335584154e609c06da7e6692679a12fc9445247646062cf0dbaed1bbe63a075a4245787e2bddc5cab0ca8
-
Filesize
157KB
MD5de10d3ed1210a55b820334f843572a90
SHA160e35d9dce3b756a96642890a8a078113c23fb92
SHA25646c49dc62adeb9fbaab315411dd84b785d5f318b78ca640db02958a6c2aa30e7
SHA51231aeea6c6aa514096a856781948193fd14ef02c12e0a9b0e8c20d2a979ad31f357dec7c8052bca0a73a4eed456ab5f5ae0dae797739b993e88e4bad8ac436004
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
96KB