Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08/10/2024, 20:21
General
-
Target
24ee27b322a2f616b19e4bd45191781e_JaffaCakes118.exe
-
Size
229KB
-
MD5
24ee27b322a2f616b19e4bd45191781e
-
SHA1
0fdc2a316f1d5ab383acd16ef15fc3a7e8344e9d
-
SHA256
27e3c183568ccc73aee6b8d8fe6412a249e7f748eb33084245a80a852be5a139
-
SHA512
04d8bdd4a5ddc338eb28b1679e1beb262199c23049de9d8f5a7f80ce361956763550a57fe2a2e43cc71a4e5f1cf7f3660ef3d65d71d152a9804b1701c70713c5
-
SSDEEP
6144:oqUTSfEGsjJRi0nlqIMSOUjSToFLZKoHv:o7E+hlUUjmoFlKoHv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ee27b322a2f616b19e4bd45191781e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24ee27b322a2f616b19e4bd45191781e_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Hdataa.exeC:\Windows\Hdataa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD524ee27b322a2f616b19e4bd45191781e
SHA10fdc2a316f1d5ab383acd16ef15fc3a7e8344e9d
SHA25627e3c183568ccc73aee6b8d8fe6412a249e7f748eb33084245a80a852be5a139
SHA51204d8bdd4a5ddc338eb28b1679e1beb262199c23049de9d8f5a7f80ce361956763550a57fe2a2e43cc71a4e5f1cf7f3660ef3d65d71d152a9804b1701c70713c5
-
Filesize
390B
MD5afcab8c9d4c3e191164b8039ac4ce0f2
SHA1fc622a995e90322a5f5b14aac1e483433c2a2176
SHA256d10c12bbb9f10a6712b9617be273ee34417149cfc2fcf0d81f87144a93906c7e
SHA512034ea33086637ec00d7d549e9d8267980b1433984e96fc582c11972ebb9b16394c4d397c8230e626ff5dbfc93ddb46848f1cf077991f82beced3349a40874bea
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB