Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
28/08/2024, 19:41
General
-
Target
c7863ca4746b2fae4495bfa6f3162077_JaffaCakes118.exe
-
Size
153KB
-
MD5
c7863ca4746b2fae4495bfa6f3162077
-
SHA1
1c81b9679f8c1cf5999e7a94aedd47bf1cb2b3b0
-
SHA256
95bf44ad7c1e827f859b2e69838fd936e703546f2b54f60c8acbb1516d93ec1d
-
SHA512
f4c31c5e01daee0ff6de447949bac02da7809d2779b31d69f11ffa6d87c017a915a6dd878d8921a7cf20afd7d9863323451b9f9212140bfb90c5bfbd44019eef
-
SSDEEP
3072:s94QzUtkEThySk9oOpz+8GHxmFLtcTjc0MiY1p:s94/h1u2UEjBFY1p
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 6 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7863ca4746b2fae4495bfa6f3162077_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c7863ca4746b2fae4495bfa6f3162077_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\R00nH4x0l2.exeC:\Windows\system32\R00nH4x0l2.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5b2abb644b7e841417e95edee2d4e8614
SHA131f3ad9493a6061fff6da386650b29f14e2d871d
SHA256adac5b908bf637dc6f1b1e8619b293038b9605a78c8f9965d1ad3b3b5b9ed4c6
SHA51261acb27e263d1ade0d59f3f2ba9fd8d950164b2fcb1b638f6aca5d3df8b1850b56d187f3bf61226cf0008a7d81815bf7b67f99fce2e440a802cb3e5efd6a31cb
-
Filesize
528B
MD51ff59a816bebfac8bd6527667756361d
SHA1ab885e1de734c070ffa47d80e8c384d1b634f409
SHA2569617c74a912118c9b193d25b226db937f00dca350a6a321d8baa6a06430e15f8
SHA51295ee0029c9352dbf2f56432a1d65377429e847ed5b52468c075068181a0e8610d06dad1c75c497e4d71127ae5366aee519264ed239b178876184ac0d112dd440
-
Filesize
47B
MD56edff0bbb52d90af63df7ef2599df1bd
SHA169af0ad4ec7130e8a5a3d55f080ae0656526cf7b
SHA256392294511359b0098fdd4a0796a4260e13c6e923fe9017e226aab3ecc2e3898b
SHA512ac48f4da4558d721f0cda431cb1b017db3dfb4a131ef0c723fc316145f0e1474f84a0cb898416d172bc22c700d54312268d1ba9376188d059420b70057e1cf6a
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
100KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
100KB