Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/09/2024, 12:24
General
-
Target
fe850b9cb64952e4ef425c2483f6e1e5_JaffaCakes118.exe
-
Size
506KB
-
MD5
fe850b9cb64952e4ef425c2483f6e1e5
-
SHA1
859d625c454b1d706d45eff9b710032f4738b3cf
-
SHA256
89aa030be1bc8c352c1e639992143bf0f0b0471344dd24fa4a0c24d46971f996
-
SHA512
5d9e401b244ba9cc8bcdebe40595b5fbba7ea0cd57039209dae0c120b087d9abefb9ea82db06b278e817e845f8f29a8234c5bcd451f734fdffac5901481d5e7f
-
SSDEEP
6144:jaUhMk70XLC1t9N9/W76hVj+VD3hbcd5SVtY/nWMSqKMXGY/uqp:jqkeLCP9NyEma3l4fM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe850b9cb64952e4ef425c2483f6e1e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe850b9cb64952e4ef425c2483f6e1e5_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Nligua.exeC:\Windows\Nligua.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506KB
MD5fe850b9cb64952e4ef425c2483f6e1e5
SHA1859d625c454b1d706d45eff9b710032f4738b3cf
SHA25689aa030be1bc8c352c1e639992143bf0f0b0471344dd24fa4a0c24d46971f996
SHA5125d9e401b244ba9cc8bcdebe40595b5fbba7ea0cd57039209dae0c120b087d9abefb9ea82db06b278e817e845f8f29a8234c5bcd451f734fdffac5901481d5e7f
-
Filesize
372B
MD5ca94f15d712ac88065d14e8f3f4ea216
SHA13b557f100c3739eb4bb5cf9e142dff7379e9e1fa
SHA25664a008a8c09ab335629eb390d485aed91b11403fe726b6c124b43b5db74f7d42
SHA51243a00d79b5f1ca99dfc512ac039771c9f5eed8926272d9b7170dbc6445f2f32938249d0efed4df40e34ab917fd046ed39d27a4446f32de170a3d25586a0e00dc
-
Filesize
232KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
232KB
-
Filesize
512KB
-
Filesize
232KB
-
Filesize
232KB