Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/02/2025, 08:53
General
-
Target
JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe
-
Size
3.6MB
-
MD5
c14112534fc0433164d8f76bb7346f7e
-
SHA1
edf1a06ed278a6717aad1a3bc2f45d04deed13c6
-
SHA256
9386fd3c18b3619e73fcf5b4d2d31ec97659fd162dac503bd1ca070c5aaa92e7
-
SHA512
4c551bc5a8951ab9a6f66ca4efee02b7b0c860ac71b1578a2160e9f355243c59e3b4f2a1fb40ecc7028915e3a359e6f86bd92532db939907e7e23b3e73b3ce22
-
SSDEEP
98304:QyGMmDNkTrfEeO9lYGmFLQo3e0WbGchxjBixQnRgJ:BG9qfMBYNe0FcX3RgJ
Malware Config
Signatures
-
Panda Stealer payload 3 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Pandastealer family
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 10 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 51 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 8 IoCs
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GIUR4.tmp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.tmp"C:\Users\Admin\AppData\Local\Temp\is-GIUR4.tmp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.tmp" /SL5="$5014E,3545120,54272,C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c14112534fc0433164d8f76bb7346f7e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A321H.tmp\v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe"C:\Users\Admin\AppData\Local\Temp\is-A321H.tmp\v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe" -nation=<h3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\V9Zip_000\NewTab-v9.exeC:\Users\Admin\AppData\Local\Temp\V9Zip_000\NewTab-v9.exe -h4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C taskkill /F /IM firefox.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Newtabs_v9.dll"5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\V9Zip_000\v9ht.exeC:\Users\Admin\AppData\Local\Temp\V9Zip_000\v9ht.exe -oem=umz-2 -app=v9nt -flag=7 -nation=<h4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c taskkill /f /im rkverify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rkverify.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD52b7598adf8886d5988d39874acce8884
SHA144aeadae9e448d23793ec6a54f7813a374e1612b
SHA256a17ee83c7919b18758bfc90c6385c5f126f3d27bd286d37af4d44fbd0e388c71
SHA512cad011f7aebb83ab4c16854de7a98a74777b64dbcd075720598e1a0d3537ff6e299ac0410834d3ebe44dbb10969f485037bb420441ad6dc30cfdd7eea55ecdf8
-
Filesize
977B
MD5236dbcdd224d62a33bbb066b24989717
SHA1c9c5536a30e241b6b33181043a74e0e0c18dd610
SHA256808e0199396b1a02b8336e4a691dbbbd162c58f4d04c200a8a3817d200f55d8a
SHA5124ea70ae351a4bc54b4e2f4485bdbee45428e01a4a381645b34c85d96525338a60460b88d8052b57858d4baeb5f0feb6063d1eb63e8762a7982244b34d5754b90
-
Filesize
1KB
MD5376eeb20e30bfabd91d263c20db442fe
SHA151ad5fab224361cc92789920d3e87f80fa406281
SHA256fdccdf8a4d0b9265bf477ccac9a8b3cd376152cf479920f897471bfc60763740
SHA5123d382fbbac34ab826db9c7edacc43ec1573b33ae111bcf4e0fedaa21ec24e7b9b8c9755260f33b03c9e260a8d63f51d7982b30d800651a6a69680213de6d0776
-
Filesize
922KB
MD59a2f642a99c19b2d7ee60109c7de1b81
SHA18543ffe5e79516d110526fd305dbeacf04b041cb
SHA256c07330c686767287b1d490f5c44d2b0265790860b32f1889d16d60c06d15f111
SHA5121a0eeea8f17d19e81bd331ce324361520339fe75d6110e664fffe7fa654a4f091bb0377e9344f90310e4c85ca37c1dc01022e18d95aee72f60c204bb38099241
-
Filesize
416KB
MD55786cf14f7421ae742fdbf2d87938c3e
SHA174aa160e54b8de667488d75a58d496c0467934b0
SHA256d85af62eab68603601a2cc8524f14395caf04505898eecf8f9e6d86b52fdc914
SHA5125a37f2dec83b19a0897d42d3972e8bad77f7d8fce6cf5840e00822ae63915cbe7bc2cd8dad646780bef720fa3d14a0ed74793204a1cb08be426314a5044ef970
-
Filesize
698KB
MD5c4bdf4e35ecfea1d422a2b4cddcd33cd
SHA12f5c45dc38ebaac577f4abd2d3371290725f788b
SHA256009f64f868ff13c1a9ef6b7a593cb4648fc2c8176f7cf8a5802328e94518e269
SHA512fe087d8462cf58d6b6ac2856cb8c3140057636d42130109abb8aa305871691c10974fe0c66923a92c89e818e4e2eb9375adddf96b340568796a0b818aaa4300c
-
Filesize
551KB
MD5a376fa73657ea9ef1e6acddb94e31c33
SHA1b48ad618e8f6660e24e148a045dc99deb0b9c559
SHA2565bf5bbe24cd97e271ddcb537299c7a6868ad3f6e23752f295cc478586778c871
SHA5123acd2fe9c922a736472bb7bdf61f5595797fcb410de8520ae2d1c118fa1b13e148d2dd0e5986b77af821c5bd17cbc52ae49466deab5288f9d30c02740b6dd8e0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
2.0MB
MD545270cbdcc4fd94c03fef3c682cf58c4
SHA1951572c1bc0fcc68fae1f83929809da3ec8627e8
SHA256beb85cba6a6096feae6e859df1d4158a1f6b094b2aaa7b2f1df5595db02d7540
SHA5129019e247efc49dec550f961589ca178c961e88a03c14397f26009ab83f2d6c0e7ce40e65dbf7e02cc21b5376dd2f0dc922263afc9e47e86baa527f7bbcaec9a8
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
240KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
240KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
2.4MB
-
Filesize
2.4MB