Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
02/10/2024, 15:00
General
-
Target
0b41ae79d6f39c034068d5b2dc2ec7a7_JaffaCakes118.exe
-
Size
70KB
-
MD5
0b41ae79d6f39c034068d5b2dc2ec7a7
-
SHA1
8095ba146c7741cb4b3df627edca185894dfb7af
-
SHA256
1a3f8a24ab6611410845314c2dbec7cbd80df2d74a34657296ce646fcbc42415
-
SHA512
a3af3e41f9a940f10d83d99c812c93c0ff31f6a751cfef5635254ddd89c47a0a5bfafd37e30d6655ee1efd2d3989c3ea87523b19c25f603306c2c4a5b7cdf780
-
SSDEEP
1536:fDV6awBrdbLkrude7mnflp4tmJHyO7UfcIBd5m7EjnDDs5E0Axpv9T:fDV6dAruRdWmJzofcILJjnDWopFT
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 3 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b41ae79d6f39c034068d5b2dc2ec7a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b41ae79d6f39c034068d5b2dc2ec7a7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5e3cb93b1d2fb9d567a8c35a325338915
SHA14673a34f9ba60581b196a713ab726a086dab5530
SHA2566f78707c80d5e62e39476d70a0b56041acb0bccc64124ca2242a1bc96ad31126
SHA512c40ce8e3eb24091a339c489576d8281e5595146306f70c1c0e91199c734b604098013a5ed8d2068d161043482e3698c45ccc033d35c0f439f4746f5757a18ca5
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB