Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/08/2024, 22:50
General
-
Target
c7ca79157132e9f2cd73a588b9ecd2b4_JaffaCakes118.exe
-
Size
376KB
-
MD5
c7ca79157132e9f2cd73a588b9ecd2b4
-
SHA1
588d9007923e666461d61f80ed8f2c15e11c7c8a
-
SHA256
c50757c6564db1b0552717f7ae01dffeff2b3159dbb5253795865eef07ba7320
-
SHA512
da8b15f55447acf8df8defdab3aaeadd5f909d5f1b7c67aff839ae4dceda64fba39656e0a343676849b92e3aca8bc254d2f4621507b856194d6ca3765dad4433
-
SSDEEP
6144:esdkfxQE1HeOOMw9X8PSyuruPzAwrt4Xrr0Tec6/LEB7U2qS+eLi:eViE1HVOxgKuP8S4X8TedTEB75qS+e
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7ca79157132e9f2cd73a588b9ecd2b4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7ca79157132e9f2cd73a588b9ecd2b4_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 6722⤵
- Program crash
-
-
C:\ProgramData\hC21703JmGjH21703\hC21703JmGjH21703.exe"C:\ProgramData\hC21703JmGjH21703\hC21703JmGjH21703.exe" "C:\Users\Admin\AppData\Local\Temp\c7ca79157132e9f2cd73a588b9ecd2b4_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 6683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2224 -ip 22241⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3932,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 676 -ip 6761⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD57b0af983436ba9128737712579798cdd
SHA1bcaa25002926a7919e5b0926aabea3fa44d89c22
SHA256e8e25fc4603402519600b241f2e8d8c107536c7747a399a42c2c934cbd951a66
SHA5120cf30e7f2047787f56b130e6f1c50a67cac57a973e178899b0f6ce4ffd2fd11ead6ccfbc9f7e580fc634208ef1970e5d28f30f3365ba1823c7d0adc7b3ba8780
-
Filesize
376KB
MD55efcf1b86413a9e59259b76844b268ea
SHA190b129550affed7a7defb06839bcf1de003ca80e
SHA2566f1e2b062d1fe0336c25ef85b610c53dc7366bc2919938ee98a0757c1bd64949
SHA5125eddb5bf81fcfcf5e388ba3d9fe6a47f6e481fe2ace2b76a48f67bd0c3db3ec6053d7cb5b596627b44017b17f2886e6a3928657c4b32b79a4e02d50f6d7e8fde
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
12KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB