Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/03/2025, 01:10
General
-
Target
JaffaCakes118_72b245a24da8bb1556a87e5d86a530b5.exe
-
Size
28KB
-
MD5
72b245a24da8bb1556a87e5d86a530b5
-
SHA1
e0ef14c4016c6d6f9372c60b2c8bcda30d37d8ed
-
SHA256
6f6d3c28682f3d4e4e41101b2f9ff315069ae1d5497d01e4f4aa3372b307aed7
-
SHA512
f41200690eb5ec8879c16e97532187b28d3b202501ee0daad07a1a8acb8c3e8bcf5395ad4036b6f4331396c12170f1c6ee4fcd5a131e37a4f03b2c118524c9ef
-
SSDEEP
384:1WxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNfYz/oxYNM:Ov8IRRdsxq1DjJcqfgYz+0M
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_72b245a24da8bb1556a87e5d86a530b5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_72b245a24da8bb1556a87e5d86a530b5.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
315B
MD514b82aec966e8e370a28053db081f4e9
SHA1a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7
-
Filesize
304B
MD5267ddfdbb8d492b25de208d84b290f1c
SHA19f57d9f19f25549e1232489a0c101a92e851de2f
SHA256ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA5120709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3
-
Filesize
304B
MD5cde2c6ec81201bdd39579745c69d502f
SHA1e025748a7d4361b2803140ed0f0abda1797f5388
SHA256a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4
-
Filesize
308B
MD55243568476eb2052b2f3b67dc9053e86
SHA1b126aa6506772f9024b76580bdf28b45e3a7f051
SHA2562d458622dc76eb87e44cc7db89309efdf50f99821145ae86864fd1b714cbaa80
SHA5123c68cef4e3daa4bca6e8b3aa5a31874be1e4dec38fe9781c6fe4890980744527d0c6818eeb519f8e6b322118e1f08302d85972fa7da4ba8be9421aabf9a77833
-
Filesize
28KB
MD5e171950dde418e2e9546e80db8eabc49
SHA12f85840e691365ed06a37a6b0f200afe72cf2990
SHA256fa507752b4aaa971e3b2bbc5337551fb1bfa5f8873744212c563d7e2533c227d
SHA5122649cd8bbe13c26f2be23da5ea6a7cad5bf217f50bf18d05b789fa07d53fe0704aa422325d8206c9893537cf7d99e2272329b5ea2359f08afa7930a4c781aeae
-
Filesize
1KB
MD591076bb431b3c82903638c8b9335c507
SHA171828b13d88b7c234879fc94d53dd7e2b330bc11
SHA25650ea7246d7544afb32df6041be29604ab48f3465cd6dd1713365e232af72984a
SHA5122ae952f1e338990904762f8a04796cee198853ac94f9ef1c51723385fc8ec96ca386535b3e22dd0b763ca06ea6d11d8c788a24b4875e418c68d80abd395e7a33
-
Filesize
1KB
MD5d65acd1f26b8ff713e2decf065402928
SHA1a73e1637b7a09350461d342b009c30093433d64f
SHA256a802e29a4d846e1c9815251fea363f86b45863e0aa8615b43a20dab7061f3853
SHA5121448706cd48d0646f0d3da7e3a5ff7bbc8ea20bc2fdde1cfb3623c02f3c9e4a28fd1e2173784bb33aa47b108d6d2202f76f79ba48b8b3454f3b618176bd5cfe0
-
Filesize
1KB
MD5a3205c0c8f704a527b6b0010ab5480c4
SHA1e2704c88458cd913c334e06859e2f51eaede091b
SHA25693d124e97cec2706967e8f3b1b706d0700282ed0b78bfa41893614ac91064b0d
SHA512299f75ffb91df6f5c1f768fb12e9eee5d840859742b871fa5a919153fb8ee3d9f637b794588d9d2eaaa99141246af9b381e2699c207f89b21c0f0b17163ac289
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB