Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/10/2024, 21:02
General
-
Target
36ca871f262c0a36429566696846f7c3_JaffaCakes118.exe
-
Size
178KB
-
MD5
36ca871f262c0a36429566696846f7c3
-
SHA1
9a06a82761bab7626f22f6d359de0f0bc7d8110d
-
SHA256
c552cd046602c1e054292a72ecfe9c3a201952800d9fc3b0b652ab610f059cbe
-
SHA512
147fb030beb80a9d5a3e9ecdd28722275f7d31467070dc411423363ee7a28f170aef388345d6a6af5a7a38b25414ae434b08e52be375d1551f0ad8647d4029ee
-
SSDEEP
3072:u0Gox2PD7tC6PNIk/WqGIvMEhc+5n6CdJK8GcBHNmjoH90DGzhQ:6ogPxWqGU/n6CbzGcBIMHIGl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ca871f262c0a36429566696846f7c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\36ca871f262c0a36429566696846f7c3_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Psycya.exeC:\Windows\Psycya.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178KB
MD536ca871f262c0a36429566696846f7c3
SHA19a06a82761bab7626f22f6d359de0f0bc7d8110d
SHA256c552cd046602c1e054292a72ecfe9c3a201952800d9fc3b0b652ab610f059cbe
SHA512147fb030beb80a9d5a3e9ecdd28722275f7d31467070dc411423363ee7a28f170aef388345d6a6af5a7a38b25414ae434b08e52be375d1551f0ad8647d4029ee
-
Filesize
390B
MD503fe087ab80ceef3f5ff8814816a24b5
SHA14557e4c82fab08471caf91c6df908000eecacb91
SHA256a3daaefdad589b89559e1aa1270d08e320fbd873329b9833677a0f0ed96c2c83
SHA5125e2cde58276cfbb71172299066f84961128882636b180b3f3697cf424813701fea4808d2f865e6da435039ee1595f6d4898f451dfd940e811e445c578ac0d96c
-
Filesize
252KB
-
Filesize
84KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB