Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/10/2024, 07:14
General
-
Target
3e7e9bc460cc38895b633e4a0da86f41_JaffaCakes118.exe
-
Size
364KB
-
MD5
3e7e9bc460cc38895b633e4a0da86f41
-
SHA1
c7d44f13d727bad3a9a0e5d0b614f6ea46919976
-
SHA256
a2de02c8a5460f997767fad7dd2a113fcda8c345b35ac18e30656b307dabfb22
-
SHA512
410f6b4b6284ce6048e998b24d3a740c0d33149bc98e031a9b50ac765b1e6d21c53cf39cb498064fa361794b6bc619a7488a6de38c4b87039b6c8cf08bc621e4
-
SSDEEP
6144:N6Q7qb77OTZEX+Kbzg6qu1JtOXOJ13EtwEGbkhdt1qs3LU4Y9:lqbCOOQtO+7EeEfzqqL
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e7e9bc460cc38895b633e4a0da86f41_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e7e9bc460cc38895b633e4a0da86f41_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3e7e9bc460cc38895b633e4a0da86f41_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e7e9bc460cc38895b633e4a0da86f41_JaffaCakes118.exe" BOMBARDAMAXIMUM2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD59290f0de175640d9b9f84ad2d99f6a3c
SHA125b1ac9810a1a7aedcf835673e8075dc0208d3d8
SHA256a38dcae8127b462bc7db096cbc67c44936f9c43ef9751c5c9f33e3ff05fe8676
SHA5126f3babee5abc3dacd9390cf5a821fa0ab555b943f080d1b77d84e112976025df2b7eecd7ee9435411a7cdbd18a1070b71ea0579975a0ebcb15887d871f333e3a
-
Filesize
192B
MD5a044078304188af481ef2ab4365628a5
SHA1d2b6e5f8c1b6369fed5ace73f6d3a37c4b4786d7
SHA25698f9e0bdcd57ec9b4c1061f8fa04fe6be80917d48cfce2ec8daf100db9b9799a
SHA512e3a918497ff5da3dfa72d014648d9772145aa68e96d83a797baf5c524c4dd8877c0ed3d4700962244aa3dceeef3bc1d112bf43fe70641d370bd2512eaf4aa87b
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB