Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/10/2024, 07:23
General
-
Target
2d259b3e21c7ae957be1cf75a570d000_JaffaCakes118.exe
-
Size
359KB
-
MD5
2d259b3e21c7ae957be1cf75a570d000
-
SHA1
431dfd53ccfbc354844ee9534089cf25c3b7133a
-
SHA256
7c6eb58ae668e8e1709b6c3a7b052183d8dc8b5ab03705df62813e7af93edbe7
-
SHA512
e000098db6ca8d7a91f8b8feaf88ea6a86bf6ae88e82d2136bb5afee8933437d7c1a0dd6fd466218ab43c5d794d710040e6871ac1ef51ab69ee03644a2296b8d
-
SSDEEP
6144:VOoY+BP6yCyrRxhY13epUWrABYk2/c+wgvD1Q0Ta:wojbt/YOUTdgr1QSa
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Kills process with taskkill 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d259b3e21c7ae957be1cf75a570d000_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d259b3e21c7ae957be1cf75a570d000_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1984 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2d259b3e21c7ae957be1cf75a570d000_JaffaCakes118.exe" & start C:\Users\Admin\AppData\Local\aiipfe.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 19843⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\aiipfe.exeC:\Users\Admin\AppData\Local\aiipfe.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
359KB
MD52d259b3e21c7ae957be1cf75a570d000
SHA1431dfd53ccfbc354844ee9534089cf25c3b7133a
SHA2567c6eb58ae668e8e1709b6c3a7b052183d8dc8b5ab03705df62813e7af93edbe7
SHA512e000098db6ca8d7a91f8b8feaf88ea6a86bf6ae88e82d2136bb5afee8933437d7c1a0dd6fd466218ab43c5d794d710040e6871ac1ef51ab69ee03644a2296b8d
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB