Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 14:18
General
-
Target
eff9fd511b62c7b9a5eb6c8584afc0cc_JaffaCakes118.exe
-
Size
134KB
-
MD5
eff9fd511b62c7b9a5eb6c8584afc0cc
-
SHA1
d173943fac4e87e17bb66e7a6d445c35c5df9a57
-
SHA256
419a0ef3d60d9be1cfaa1ff897a8713d9699b4950b2fe932312a66f3f7a757e3
-
SHA512
fe12a4057cd9b6a6ad16c491976dcdb99918be84790608b9ffac7a76a2ed8500f07dd61d96328833737f6446a72f484b6c9006e7164e6db52b1c4c297d4b2f08
-
SSDEEP
3072:KL1SE8b1R1Fw6qPrZZGa68rBSf77Ul09z7AeF:w1SE8l6LHGa6gk77UloMeF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eff9fd511b62c7b9a5eb6c8584afc0cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eff9fd511b62c7b9a5eb6c8584afc0cc_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Pxania.exeC:\Windows\Pxania.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5eff9fd511b62c7b9a5eb6c8584afc0cc
SHA1d173943fac4e87e17bb66e7a6d445c35c5df9a57
SHA256419a0ef3d60d9be1cfaa1ff897a8713d9699b4950b2fe932312a66f3f7a757e3
SHA512fe12a4057cd9b6a6ad16c491976dcdb99918be84790608b9ffac7a76a2ed8500f07dd61d96328833737f6446a72f484b6c9006e7164e6db52b1c4c297d4b2f08
-
Filesize
390B
MD51df03ba159d9865e07b6dd01d687ae4d
SHA1fb6c4e596ec732489a3fa437a61656f3667f0e43
SHA2560bba411f13f572df759bfe7cc56be94146549fae78f030199f21c03b1f967529
SHA512f83a0de339c6514484b23722260dd2f566652824be1d05bd86755c9073a1c07e62ea45d3c6e5f59f85bafc6559ab66370fd5db809db8e98c9c9636946da17212
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB