Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11/03/2025, 03:01
General
-
Target
JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe
-
Size
95KB
-
MD5
62d30a0fb6d882c87f76f5884995a403
-
SHA1
e3a71cf27afabea262351a1ae4b57fe8519a75d0
-
SHA256
2a9868299a50d7fc4776e4848c20fe29645143eaa11cf8385b017cc076f8a9d7
-
SHA512
a6393e1a1d0c341a5be8027b36aab46e7203750e84047aee961b8c4614f0050dfdeb8c0286d62555fb51c016b209542886d8e9d631f9cea21d7088d3212cc88a
-
SSDEEP
1536:SYFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prFm2d11V:SKS4jHS8q/3nTzePCwNUh4E9Fm2d11V
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\isellekcfu"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62d30a0fb6d882c87f76f5884995a403.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_62d30a0fb6d882c87f76f5884995a403.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.0MB
MD5246a7c4e098c82224afd8919bec692a5
SHA1e29379f36d95ebcbeb7705573b4eb348d2411f97
SHA2569b5152c43049a101daae3cb6aecdb4ba1ee63225982213becb0cccd1c67b45b9
SHA5129fc52cccf00defae2bdd0f36652bb523aa54e11da194bf0e7722d4e74df521e22f866412145e14f07c63195b57a159b3315d9e27f04a3b55c994f3e3d43cf9cc
-
Filesize
19.5MB
MD56f8237ebd65d820701fc55051977fc30
SHA187ec377e28c27a10f00805cd6ff13ebe9a776027
SHA256b33fdaaea7a72f317bdcff8184f6f596e53c6fa21a3a55809dac8566d291af66
SHA5122508bc0e8c48b0945e335a0250aec7d257ef3fd2aaafd8ba86880c9b933de92f71a32e20e5f60bcbb1673264be645c9519171a306455b3a81a7a5d8eed660e16
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
313KB
-
Filesize
313KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
313KB
-
Filesize
313KB
-
Filesize
4KB