Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28/08/2024, 18:19
General
-
Target
c76530899637831fd1ec3f281fda195a_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
c76530899637831fd1ec3f281fda195a
-
SHA1
207445fe509e567da3b3de081fc5e5334b2d77b2
-
SHA256
a2b99bc286042b301692432559d915a6e8ae19f143afb9f91e6e5c51445ad925
-
SHA512
fe933b0c19027e6a7fec65e9da04a3902db3509157c0b471289b13e1eab4d8f34776e78012210e8d1addeb52ed925b0136305c2aaaf761c8eed8b188562f3833
-
SSDEEP
24576:NhtOJF7fjodcrAh2LbBa4QhdvdL6sgMUQhG+oomy0r0DO/:NLO3LjouAh2LbOLdLAqooE
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c76530899637831fd1ec3f281fda195a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c76530899637831fd1ec3f281fda195a_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
600B
MD507bfd80e8eca0988febd89fce02f7de3
SHA1c9bcbe59d26c143c112a35e139e2f48458269e40
SHA256fb8190d49ac87314c1a387ee168d6d6f895e1cf9f460771121715a521e761af5
SHA512f2a0fe2233b25d68b9fbaa9fad16fa9b6822bb187f8b36958431a571839bc9e9213ee59275f5f0976dd142748fd43f4109f99c749e4d17eca3f6bfafe5f68a7f
-
Filesize
600B
MD5e3bf85079345c0ef972637cb41c21f3d
SHA1a8a5dfce21cf423f2e554bfc77ac694eef1f7b63
SHA256086fce9afed38f8a0454f289fe20d75f595ede0019e4570e31d60200c0c9fe4d
SHA5121de7eed8d904c9d4884214bc8d911af480afb351ded7b7a25e83e278d74a4678daa1073138a83af51507c13f0d5ffe8e6bdcebfed6628837a31f6460ee514199
-
Filesize
600B
MD55525feec35d53a4956d45876e91fb4d0
SHA1dda0c450996f7edddbec2f2baa48b5df1c14e29e
SHA256b8303d9e482dd1b125931a96bd3d46b816e8f886e0f5142eb1a80b561642e5d0
SHA5123d319b1b4e40c4cbfbf749052c65320cd1fc6c3e08eae43592273a58fc4fb601b4e368ac9145597cb9a238d82a32f22931395529256e9d836d2b150895fc5156
-
Filesize
600B
MD59a6aea94cf9061ed1c08ace2a3d20996
SHA14430340c89caf1cde8a198ec511f8f094ae99bdb
SHA25696158827200bebe94bbda83a381d61878d355b4e1aa6e645a082c41ac92e4440
SHA51286d79f5daeff0c9988dc8861a6a1c296d8f09409bd165aa750ef50fa0b7268374dc13e74d0d4d8a2223e1088a04a4dc772fe621c09832b001e895adafd798756
-
Filesize
600B
MD57e2e60608e9dee6e61a50112b7621313
SHA1e82dce016ea56cdaef67106365ff1c0e2e3cbd73
SHA25699f4541217b4f7b9edc1bc12854abef78d712c5ddf9327d5f0818e813ccb2c5e
SHA512dc639c5beb784aa17b281c03db34febf7c6d47379f429c5d6e3ae82a43537a587f22d6ec70e40330255e521037c8fb51efb2ce70dd469f97b5f78e1bf01cadcb
-
Filesize
600B
MD5ba464592c36806dfdb046e26682caf92
SHA173a41640b2584bce319aa4ecbbebbfc6fc8c12f0
SHA256a4bd0490b548225c953e1e98743f4b41513b3b4965ce41ba69600b17b4de7fdc
SHA512dc2fbdad63711ee1c3087331023ff7494dee0d92f79943b914dd0c20ad5c4a7137cd614ad4e0d06a40cee30efd30cd057e87430ce11ca9f187786047a2cb49ff
-
Filesize
600B
MD5dc40098d7a7c2407f6988618fec91669
SHA1c3c40e6d70c3c04c3cd05f562b4646b62b97f5a7
SHA256c9806274f7c6ef2d84ecc3b992346ad973ef9be00d524d12e5c736d7181ade58
SHA512345691c20fd35d88469e1c4d95513fcd2b243c2f5862bc89f6bfdbc333672b49d8a7e12226cce713b3e3e779304e2db779b3b368eb743bab118a4a894cceaa2a
-
Filesize
600B
MD5c76852baef6a661496803f2e87f23f55
SHA1854ca1399661b3db9b753bcfadf3762713c087b3
SHA256a28860ab50e6ee48777bf847380ed6e523064a42f34406421eb3ce01c6cec695
SHA512c017d2da5860134e2160465a971b664de885bf0f5f5e13213e7e4d91cb2d6d2c57ff6d903fcc40a1be61136749169a75453af365bf7f2d6449298d45da0b08bb
-
Filesize
600B
MD57fe3e5cbe0414b36a7aca1eb67731d03
SHA19a2b10b533bc3ec5751df2cdf0fa6aacef421f61
SHA25674ff29377b35b5b4628edb2887aa393c0b8e87e14da0e2dc673a243c43e7df44
SHA5122d13f730f76e2011258f2afdda9203ab0e22ac8207965793e2bc111d4ac71d79918c61b409cdf5e7f7ebf4b1f0e81c622342907f09869212325f1fd30413bf8b
-
Filesize
600B
MD55ac5687abb8b52613cf3005fd349346b
SHA11a5dc67e1041231fce83bdce06229a48157cc62a
SHA256d2f9a3d7575d18b9ee5696df9fda2d5a42146ef576f83011aa7c7c0560f65377
SHA512d0f110dd97bc1791ab46006612180bf3ced94cd807053b44e2609904e290ea3f49b404d1a806cbd0d2d74556278fed98a9673ba6806ace1bd73d680fa55327fa
-
Filesize
600B
MD51679abd0186934537b1fa0f8d0e61c67
SHA1915151c39754552e45c68844f6540836ce210304
SHA256dfd882d5c121f38233f9d04e9d9ad3e65d6f3642e6dc7277ce0fae33cc09c6d7
SHA5120c85948c85f1b50d92b6027671f76757ce337a92e8bec5b5a30e315f47979b6b0de474e62e8fe645b597e370de19bce66500b29512d9d569720e7abeb02a676b
-
Filesize
600B
MD505d49657707ced913b82d624190f3658
SHA1c6c1c7bff74c01a70813be917b6dd7b657f703a0
SHA2565f336a992ead8f2c8b89c5a176da4adfec229bceda9c578dd0ac83dd03a96243
SHA512a3a7ce826d6500c2fa517ff5cb096b7ed675a4e4096bb91fbe61992b3ac1ce79f2707c117d91f67ff8c78512e47ca98d26271160c7b7e0497bd012510b6f358e
-
Filesize
600B
MD5d6645591289ef5d400b04ff8f1f1dd01
SHA14dba12ae5083019c235cf8fac8a329d874305975
SHA25609451e72b51b26156238a4eaba42794c0d194c46fc86a1c8b9991b4fc9847459
SHA51220d10884b56bc555537fbde012614fd14523c112729f92614bb2dbd663dc09c8fc3aa72772cae2f00eec217f626bc53bef6a8544eda973e4c36d8d6a8e2cfc09
-
Filesize
600B
MD50ba1367b6fde4df18c0f39ee0e362d95
SHA1187238ed62c4e1008a2af13bb2ccafc5a6972fb9
SHA25622ec313b122da577a94a4315cccefd1e98d8cf8425ba8c60235ae1aa050ee58b
SHA512cb4e3c5056eb30be52c9bafbea69136ff6521ec2e4c5267f4f60a26913b98477433935e4e9b00a4f0e9a6fccf329754ba78cd67fefdb59dabdafbe6ef597e252
-
Filesize
600B
MD597c984a0ddaa28760607511db31e9e5d
SHA1fc0a679aea5607ec41eb98ca705802602ce75cad
SHA256dd06182bd868ce74313bd7804c5295e6fdf6eae1da8a3b5785842ec922a38867
SHA5123f4450451122cca4a0b082d5c12ad1e84bc520e033a1eac83046713b42b10ef06dff249031bc4e2592b783d36ceff2ee0ae665df6a7c7dfe9ba2a231f5a4d03c
-
Filesize
600B
MD5371b3c1a71f5a83ea05058eb100223d5
SHA10d6038fba32017a2b2110319421d330d0aa00452
SHA2567e3b6d0cc90939d3edf70bf781bb7b278db0df075ef3c27cd25d10b147faf887
SHA5125f24358b56d48afce5c33ff49a048ee32e9c92d21d7af3b46632c8f8a9d1a7c0ad6600eb29fd7be21a9b1406bd7b701212ccb39b6ad7ba918320835c68691d1a
-
Filesize
600B
MD536d8ccb6df57a8a86cc82d6cbc1201fd
SHA1b6505443806dde1e376840e9a8b33e284ae6c7e0
SHA25677cb784f0e862b24f9e64a50fc9d9a5eb0b14c68248c5075a5dcfabe181b8472
SHA5122aaf149d3128b09178c31be1a9f5feb2910717757290e46e85565d2679f63f0eba6ad72d35269521a8e06e08152a4197e8c05261701e95506911e5de05786774
-
Filesize
600B
MD5004c453316639e93c50cc63365f9c5d6
SHA1573c242fdf0e1bcdd4df94839b139dd86d75e156
SHA256ab5af4038f3a1ff7c9449d805cd9c4d049073e6639883ab93a8f09a566660360
SHA512cc3a9ccb440b540606e8008506738944f76d21ac6d14b30ca0f0fa5e76be8486db19d5965aded8da980b89eb10480b3766837216d4c5733cb7256508e5fb4e29
-
Filesize
600B
MD57bd00956531bff6cb8ec83e846afe44a
SHA123d92c4105a3e49ae55d6e627ef1567abd603e41
SHA2569d1c19df29636fc7a2ab82a408c8fb39b7b89cb69208125cb57949dcdd22775c
SHA5127cfdd7b9785ab4bc6468fcb2433867606de57b34dae5f5e5ea939c792bcfc9d859e45054ea4f10e0ef7db4506caee6c20323d8f3b7388a408b429f9097f7de97
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
388KB
-
Filesize
8KB