Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
07/09/2024, 10:22
General
-
Target
d1b541014a138aaef73e4ceeb45f3f13_JaffaCakes118.exe
-
Size
148KB
-
MD5
d1b541014a138aaef73e4ceeb45f3f13
-
SHA1
2d6b931c90b369397f9afd64c3b99399092b0fc5
-
SHA256
c16af379bedf7e1b02c6e365225352c882d09f64b36d25d4a19c1cde3bdc30d9
-
SHA512
d38b2ff0f218c26530a165781ff616cc24d4bdaa30848efac83fbf1736ba82dc2fd44c6ce190165bc2487a969325cdad03174f0754d9fda096b8c6d65f6c57f9
-
SSDEEP
3072:eg2Oc8eNjzgD+lpwhalNOBzAvB5xySq4BV7Mk3747pz:p68elhAh04BzaBDXq48p
Malware Config
Signatures
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b541014a138aaef73e4ceeb45f3f13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1b541014a138aaef73e4ceeb45f3f13_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\taskeng.exetaskeng.exe {B8CF3B81-3E9A-45BD-BBB5-8A122B6B0D48} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d1b541014a138aaef73e4ceeb45f3f13_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d1b541014a138aaef73e4ceeb45f3f13_JaffaCakes118.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372B
MD5ee582b939477eba4e7e4087f965822c1
SHA14d5e6da9c5edc7b1bd5a91ba0a9bd5797f22bbf0
SHA25664a23db1ab3ad88e720e8aa6b3ebb004cd573ee1e8f340ecea0c762b37f1b7c5
SHA5126705e957177a6cde1849f2003b3f1b3c51b272cb9600b7cdcc6b4dd298a6c9dde954bfe3c6355b342d79b6566ce5fee288f6d837c1726e8305e57bd5c8e795fc
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
208KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.4MB
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
208KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
208KB