Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28/08/2024, 17:53
General
-
Target
c75b0522bcab18c5e48fa538f768b0e2_JaffaCakes118.exe
-
Size
368KB
-
MD5
c75b0522bcab18c5e48fa538f768b0e2
-
SHA1
81c495dfab250afee32f17650cc3f6cd3026e120
-
SHA256
4c42245b86d977cb8a93103b0f628bc8b08e92a6a07a7eabd6f16368269e39d9
-
SHA512
37d79d4d8904fe6967e25d4178d14cf0378cc44791e295d22a5cc0d62e206c79c6c8c85ea00a540f5b82227dbdb3c309de830617b9938c8546bab248e894bd75
-
SSDEEP
6144:4zWLBJJm5cp5jDmmuApRr4IxaZS9rL0TZLl9+sdcPyVS+SbU1JXnI3w9bGGeybJ5:4zWjWApKC0lTcPu1F1JXnC+CPyXgltmR
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c75b0522bcab18c5e48fa538f768b0e2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c75b0522bcab18c5e48fa538f768b0e2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\kF01605NpDjF01605\kF01605NpDjF01605.exe"C:\ProgramData\kF01605NpDjF01605\kF01605NpDjF01605.exe" "C:\Users\Admin\AppData\Local\Temp\c75b0522bcab18c5e48fa538f768b0e2_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5e469a79aad2f58d4f35c2beffac1cbd5
SHA176c17b7365b3a8df12b90f14925675a7c0ed3aa1
SHA256d1e8e820a41b996e2d28098aa78247a191930bcc82b7e932160a9b3411779ae1
SHA51276d9a25a29dea06863767c11808e4b22ace4f40bfc8481a64038dc49392bd5af9e1ace4ac9a44af0bbe2bbf7e674e6dae8e2f4153cdee11f062cf8c4a31d35db
-
Filesize
368KB
MD519a88e7a85620f018c27746bec9c363a
SHA15dbabf8345e62b9d7c89c73822ad5aadc7964d36
SHA256e2acf4a5aace14926383f7943120ef11d45f6e6467b14b0bb375533a6862b53e
SHA5127b4effa8fce998e1c5c2b1bdc42dc19a85b1371ca84a0a71a606b3bdb52768314c41c6a7ad7ef7320454f30b94e113589047f12f25b045ba0ec593b4eb1a24c1
-
Filesize
12KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB