Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 07:08
General
-
Target
0e832e574510a22951c300d7782c448a_JaffaCakes118.exe
-
Size
386KB
-
MD5
0e832e574510a22951c300d7782c448a
-
SHA1
8eb822278a93ea45052413627ccc9bdafebec93a
-
SHA256
7595cc3dfdaab2451a9ef5cbbcf259ec2636e37bcf88765d5c1acbc2bb16f2d1
-
SHA512
e152ed07fc4d4f6ee0a9fde6adfd574f2156c7fb7ea63c7994258a0e1b064513130d2e221ec5b71477084d62287f882a2274caf005b8dce5b4f9722082d3887f
-
SSDEEP
6144:xqMDEd0sOsFObZsdV42A88jntY5Kt5Fx6Jbs27TPy4Ghb4JP30pIX:pDEj/UV2N8DtrgbsD+JP0pIX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e832e574510a22951c300d7782c448a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e832e574510a22951c300d7782c448a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\mH28601NlKfP28601\mH28601NlKfP28601.exe"C:\ProgramData\mH28601NlKfP28601\mH28601NlKfP28601.exe" "C:\Users\Admin\AppData\Local\Temp\0e832e574510a22951c300d7782c448a_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
386KB
MD5f135b00d7d54e3c4b0284d127aa52b80
SHA1c1873102873f4e11bf1a73467a0c2b195429b86c
SHA2560011b23f8adfb341e4f5df1331a0457536674d2099165f6ca33868f59ec1bb58
SHA512734ff8d518c2926525d3b90ddb63c27e2fc5d3c1cc6ddd2bda37a8c20a2779889077ae738a230b26d42cd639c31a0b040176dee9eeec4aa35bd29fa6a639e4ce
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
8KB
-
Filesize
772KB
-
Filesize
772KB