Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/03/2025, 22:09
General
-
Target
JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe
-
Size
28KB
-
MD5
78181c38bdd1daba2d3418965029748f
-
SHA1
56e7c79f628cdedc6f0ae4c0a3ec4d6c373f9d3e
-
SHA256
530730d7dec602c822fbb0db2e3c922c00657a925fc393945a13c455ebc58f32
-
SHA512
0ac6bd5db6a56718e66b636844435f0e1c7cccc9a76fac78d9099ffbd4ca24e1f0d08d51342da6dadeee0fa286428f901306e53fa82885b330901c8d9ff51525
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNQKdE:Dv8IRRdsxq1DjJcqfNKe
Malware Config
Signatures
-
Detected microsoft outlook phishing page 2 IoCs
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78181c38bdd1daba2d3418965029748f.exe"1⤵
- Detected microsoft outlook phishing page
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD51a3af9780cdb674e6d9ff97d777df421
SHA17e51d0d145ffcb4d2e422e83872d1122fa26f855
SHA256b509bb750c13ec5197cf9a3c4931d4de8aa94c5007f1fd60c379c49fd92182b0
SHA512fc4609f86c83bdd845af089f690642c60cf4d26d45ce152d2bc3068ad4a15b2781ac83249861ff1f8f1406ff72f5921bb75b3e313a0eb20b729029f94e5189ff
-
Filesize
28KB
MD54682fdc09b020c928ea2b3e72d1b12e5
SHA175b4d72864cef126616eb06de62973eed9824c4f
SHA256552173a2c62f23d9085980327a76a5bf5f1a7931c173f95bf2d918b67dc41bad
SHA512f5d5aa797f7504b7fa5a948a63621c40579087c3eb2182ba35e2688a84fe7367491e6379997bb5fa9d55dd0604186b0d5ff2f094497f528f9a63da1e2554e7ec
-
Filesize
1KB
MD543065b80c0779f0dc28a224d3a88802e
SHA1dfb81de0b02644f8ca1f846aaba320d48c40fedb
SHA256488a0862291bae6fe3e8c30e34ec932d691270f74ccb9ade8f44f293c17f1ca9
SHA51277daca0319433636c6b0574b0dec72d5bc366f258d03b67e0ee7d843e89a1fcfed7aec0b81fabc24ff296293a51c6682140962d7a62723dd1c96e649cb3438db
-
Filesize
1KB
MD579a93906440151d6e6be90c3567f0fad
SHA1a1272b4a0acf2acf0cd5634caec9335c2df0d2f5
SHA256a3e579da498723405358cfa46b56f9b52a86b414980fdbeee17a40998cd56a24
SHA5120a85c99a4f11076c825a61389d2c8ab165a884331246c93d89b2f14b4d854e9531cc8df24cf5703eb00fd103c6db3a619620d5f98a37b43d7cdf04ccfb48659f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB