Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/03/2025, 09:19
General
-
Target
JaffaCakes118_75ebdb8447bdfa3bf1254adcf2b55f8e.exe
-
Size
28KB
-
MD5
75ebdb8447bdfa3bf1254adcf2b55f8e
-
SHA1
f0228beaef5492c71d15f26b865e1b88c5821126
-
SHA256
7653736a8270a720f932132456f56f0d63b66e928f6d77ea6b6ee67e7c7afb6e
-
SHA512
8c366cf28a141279e7fcf1f2b53ac6d10e105079183ee1a20b39d9e72761653402bf4fd4ef9e2ae031d74a3add3e3a12d9ab720ec25c958da45faf9436241957
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNFvM:Dv8IRRdsxq1DjJcqfMk
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_75ebdb8447bdfa3bf1254adcf2b55f8e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_75ebdb8447bdfa3bf1254adcf2b55f8e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
138KB
MD55fae95b7a9abe625740e512cc410b0e7
SHA1a7b02cafa7ddb8777da4e20d4ba238d3857799b1
SHA256e8a5e45cd9c1d78bd2a691e83cd5ac16abd5f38087ff34a59a6381828aa533d0
SHA51209bedbdf8836965fa1bb8ed05fd92dac892fcf93282bdcc88a9c92bf609fce256cbb72d9286e6c41ab45f3d30a6ecdd115f70b1962441273695100467582c721
-
Filesize
153KB
MD518724a95d3a5290287ddde0c53d87ca8
SHA1dfc25ad6cfd53c24e8d327b33ed3f03db287aa4e
SHA25657b15fa530d1e8044401c646c5a6ad8ba444ac593c653105ed83346dfc75008a
SHA512d0c549c197496997f916882391af927998c8d3ff088efb5c78d6ac25e9fffd26d9c6b03d9ce26e4d5ec264f6816fa5256d54e929d19f506cc1599f7fa08998ae
-
Filesize
28KB
MD59d76286b1a20cd1538906cde0d8e079b
SHA1f396afc841ae09f66cafac587c5c423650bb1856
SHA2569d8ce08101320579b269ca8af32be4c6abf0a56ba009dbb9ef1c07d721de0d57
SHA51292b7ccc874353198f3fcaeb20b3e1a45d1573a2d9e522d050207619d87b78e331e64695cb91b49a6555358642cd4376c0cd8d8c009f63d50565ae28276e3170c
-
Filesize
1KB
MD5497ebaeda9ca4683977c5710d94ea9f9
SHA1897d7f8be800fb0a927d32222056a65a31bdd4db
SHA256ba3c6f67ce7304f5b1c6b0c4fc512573440d86bc940cb709dc7e135356e9f0f1
SHA5123b7a61b69aca1eb07f9afd4d2c940758f4d9321541136601ace170e2a030e34e29ef73a7e28e3f72215aa2c02ba5b7d7395a78c5f089efd4fe884171d5eac7cd
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB