Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03/01/2025, 07:24
General
-
Target
JaffaCakes118_6b0eff7c522a44df82f7be072b45eedb.exe
-
Size
28KB
-
MD5
6b0eff7c522a44df82f7be072b45eedb
-
SHA1
4d006b00c5a52bafbb04d349f89c19cac17e6bfa
-
SHA256
65475ce143933d47dec32c4569237145f2e55cdd3679ee47921d250a9800bb50
-
SHA512
2e57407fbacfb4d9a8714087bf46dab0a08d54a18d590575eac5ab2f8f0333722a8e4a4672bcdfda82ef40d0ea70616ecaac3373b96fe57a705b4b45c17f1fbb
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNIqw6T:Dv8IRRdsxq1DjJcqfRUT
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b0eff7c522a44df82f7be072b45eedb.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b0eff7c522a44df82f7be072b45eedb.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
116KB
MD5f1b3f7fc1066dc5f829027f5fde3343f
SHA179787077933cb3950d8f1676fd2610c4135969fd
SHA2561e48b16e7e6ab7fc5fe6e0a5e4a285f17a266c924ce1af9f74ef0b880bf4e883
SHA512d7f8b6d71ba899d8bdf38a6efebca26ff7dc16ec3587b057d6c38638b8e30cfa46479f4c5bd36c952145cab230c4432d1219d7e119d41eb7b8452649a5766eb5
-
Filesize
1KB
MD5b8804feec8cfbace2d85321e62145a87
SHA1d897b78892a97b492d652680946460895a1d58d9
SHA256d2b942e207efaa8f2494e8b44b27aed94c8da03f5da2c08af5648130890696ae
SHA512670098454e7037aa814481f1ad6c4c9eb609473bbc35e5e24157705b3fe05c84d2e464689ae05227d818c9821ace013d6bea7d9adc7285d5ca2ea1d79b6a3f11
-
Filesize
28KB
MD5d1bf8ac2a47d81b1a79297d1d39d1edc
SHA19f156d511e66762a38ed784662f006803025557f
SHA256112e25723e34ec29c4f6a68b0fe09746d2aa981eb800d1dbc4d452e5a02c860f
SHA5128f2fe3dbbde9c057756f0ebe0198c420d69f0d446ffebe1201c5440a28b0b73d300b27f731ea9add6d23d2af3c5bf0b55224c67ba8f4799a57e468066d37835f
-
Filesize
1KB
MD58ebcc27558ad21a78ad74ec833006e83
SHA1b4670f25ba1bf61d282fc5851e9669caf648db6c
SHA2562f01668ad229295a73f5d2b917d55de41b714ef4488b0e6ecb7632b9fcac02d9
SHA51256cc25e60e069bddb66d1cddd56f2da15e5a4ae00a21c8c8599973f18f0866231be0b1eb1e73215d4bb81c1de2fdf6fc11ce821b4ab34347c9c6af4d3a6ccc66
-
Filesize
1KB
MD5c574aeb262ec90f0be158aa1c0db226b
SHA18afa4e75afa9d7acabf2eb7b571e83e5cbae7d4a
SHA256958885c407abef175dfff32daa8044085de7becac1ba8106732491205a86ff99
SHA512bd4346f8f8d538a0f6d247477f0d72ebcc7ca83e8ecc9a138c7e85a116e8ca8fc3f8555ad101247634bd3cdc7fb484af56d9adf52208e6fce10f9741186cc4b1
-
Filesize
1KB
MD5680a2c38304317473c1525c856a25088
SHA1979bc272416e20c201f1d2c3db8c88e505941404
SHA256929a3e99c13a12a94ffb072e7ce5b5c0c8028039d1814ff49e803ab6e180f5a8
SHA5127c8c9d4036b382d2c242481a96bc97f61b12048fa689fcfc7a3f19779557d8f1e6d1863d3bd6aa37adbcead7ccf97572944ab9f1e550cb96e27fe9753da7ac26
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB