Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

392c777f11...18.exe

windows7-x64

10

392c777f11...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2024, 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    392c777f11cda68aca6f5a470178bdbf_JaffaCakes118.exe

  • Size

    164KB

  • MD5

    392c777f11cda68aca6f5a470178bdbf

  • SHA1

    cbe9ddeff7a59adbbf128ea2e52080966554390c

  • SHA256

    95d702bd69a049621b0db38d41a53e7277afd9dd6a9c5be60470fee4f5a0e025

  • SHA512

    3b485abd981d813ee54a49df066dd08afa80d679ca100430d1ef01ddc7ad6e1dc605c0c802fd5c139ad24966c68715d5b5bd12da1e056f515626a2e011985744

  • SSDEEP

    3072:+2M+eV02GJyjqGFvEZM1hLUCPXXgKVxkzP/Xk19LE+GlMt2IFYEdePWj6D8NNHfd:+k2GJyjqGFvEZM1hLUCfgKVxkzPPk1x+

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\392c777f11cda68aca6f5a470178bdbf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\392c777f11cda68aca6f5a470178bdbf_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Users\Admin\reuyouh.exe
      "C:\Users\Admin\reuyouh.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\reuyouh.exe
    Filesize

    164KB

    MD5

    705b4276074ba190e4ad08ef2cefeb23

    SHA1

    af2f2a76c312e1426815b77c2aba2b71030fc8ba

    SHA256

    fbbaca52076ac0c1169ea0526adddeb68be26713b43cbbd4fe8ed829beb0189a

    SHA512

    e453cb6b388a8b5899618f77352153fa2b9918733318c3c05787261adf08fa0a75f6297d959c49b4981f947967925bc8e99a123f706eebb4ea0ae1ff524ee037

    Download Submit