Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/10/2024, 03:22
Errors
General
-
Target
11a13418d08527a1df11a91aa6560863_JaffaCakes118.exe
-
Size
282KB
-
MD5
11a13418d08527a1df11a91aa6560863
-
SHA1
ff4fb55fe1aa7ffbb79775b16ade23afd395d39b
-
SHA256
737ba07e36e4c3eeb668b5425b332178c504194abe72000e2605a53555087b90
-
SHA512
74af708b092a83bdeb8d7c0b0e72ecb7e2508241360d8d8861b333180c9823ae3cd19feb9436d8fc8239791d63970622daa8fde1276b39c7cd33e9aafda50536
-
SSDEEP
6144:Izf/4vdu9hHaZBynO1qQZq2kwJD7DOZa6emP/CvL:Izf/X9hHXQY2kqD7DOw6eeaT
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 27 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 11 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11a13418d08527a1df11a91aa6560863_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11a13418d08527a1df11a91aa6560863_JaffaCakes118.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\11a13418d08527a1df11a91aa6560863_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\11a13418d08527a1df11a91aa6560863_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\56321\E5AD1.exe%C:\Users\Admin\AppData\Roaming\563212⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\11a13418d08527a1df11a91aa6560863_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\11a13418d08527a1df11a91aa6560863_JaffaCakes118.exe startC:\Program Files (x86)\21DCB\lvvm.exe%C:\Program Files (x86)\21DCB2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD56a406ad96e5b0fb95b19fd5c525659e8
SHA189c48a17daeb402c78a406ed31980ce381c1e66a
SHA256fff6d4beb65672c459a492cf64ebdcc3ae0b5e635533fd761876300e1f4da6a5
SHA512c336db63c06d794ea67bd2d779db15777d1caf244119e76bd640e58e0168afc52dd744be20dfa4bdeb45dfb9435e3cc187099c1ac745d8a7e19ed9a343d886de
-
Filesize
420B
MD5b3e1373f7de40116f803aaff016b74bd
SHA141f0df17f271b896d4f82fd6d83cbddffdc8ed64
SHA256b583caa78c719c82870b6ae330a683002a439bfcf93ada6efb5882e651a7eda6
SHA512ce11f581dd3fd221915f63f8d93186de38a7f959705d843c667e05d1d53eb2fa0c026dd4be1a9edfe2e6c22bcdc79c3edb1d8af288fc5d3bc29f000fbac22122
-
Filesize
996B
MD5a221aef49058dd083cf55ccee16a3925
SHA12ef3577a539c99a446a9a3e2b534f7d9aeb05720
SHA2566ed85758acea29a69e969ce96b4321f262743969ecf6a29b70169897b4bb2a4c
SHA5124deb59ae9a000a98726966e1173d41887ef1f75116e730904fb783235c903edaec050c6a6271d04f9b2b507b35ca0cfc8be54989a973dd7857e75a627d08c11c
-
Filesize
600B
MD51672c197f8a69919103d99bb4e332129
SHA11f4e9ba8c93d4710003080660b942368c33cf4e2
SHA256ea1004d2dbd2276fd74a53c81b2dc095588fcacaa13c8869ec41744fbe2c9614
SHA512e0a4914061281d41344a996d5520781ee36d87001ade83806b883553bd5c75269c96d355c895b5155d8954c755e30c071d9b8f1cfd05ffed1e0e1a3622d060cf
-
Filesize
1KB
MD5f287354d540c831528ec25ade43bbf98
SHA1c8cf3dfd8228a75b85df6798e3f2634b256626b0
SHA256cb363ab200ba6a04090b13cff1821213aae89976003c2048054a8a6d02895245
SHA51295fefd2c22a01f72ac30a2916d3775da9faee405d005c007ca121a0ceaec03584b2f20c0f0a1c4bdfec6f138597d5209418499a076b20870aef0eecb811bdba7
-
Filesize
300B
MD528396d5db9ec67731c558c7a9ee624b8
SHA1e8e9856383b7250f552edca9f641e1d9cc459755
SHA2567f1dd112a970d0a843dd1d81ba35bdf710544f4dd7eaeb448f37ba4aa3bf015f
SHA5129b5db57c0ab244a7e4d954294fe31babdc1c17c5f93ae34a7b97f261b482c62dcbcf4b4e28e3a9b813590ffc390f0f1b8617ec00131980ee3d1fa5a68fb78f56
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
4KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
416KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB