Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
20/03/2025, 08:54
General
-
Target
JaffaCakes118_822b321bdbafd7484215265d223a1f11.exe
-
Size
28KB
-
MD5
822b321bdbafd7484215265d223a1f11
-
SHA1
09fc702a7d019efd48b236d458164ce9f5204bca
-
SHA256
122ceed201fa3886b02c3c507487b7f8434367efed443e012435d33f3e0bd457
-
SHA512
abf25df4051581e1c4824e3f239f46e768cddb05f8b502c6422b68b2da175de0945242add8409f0657d371a62c494a2873c6f7facb5d9eacbf0be336e9cb7489
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNd5a:Dv8IRRdsxq1DjJcqfk5a
Malware Config
Signatures
-
Detected microsoft outlook phishing page 1 IoCs
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_822b321bdbafd7484215265d223a1f11.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_822b321bdbafd7484215265d223a1f11.exe"1⤵
- Detected microsoft outlook phishing page
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5822b321bdbafd7484215265d223a1f11
SHA109fc702a7d019efd48b236d458164ce9f5204bca
SHA256122ceed201fa3886b02c3c507487b7f8434367efed443e012435d33f3e0bd457
SHA512abf25df4051581e1c4824e3f239f46e768cddb05f8b502c6422b68b2da175de0945242add8409f0657d371a62c494a2873c6f7facb5d9eacbf0be336e9cb7489
-
Filesize
1KB
MD5dcdfd7f7c31e48ea3c04e68f4daa6f11
SHA18838d37725fd08dcc67d3825d772a662994b6803
SHA256c65b78750d6787cbd40225d1675f851a55ee7d17ab5c51f6601fe6ab87f7ab99
SHA512dc76b72255b3d6ebb2af845a1374f0189b095105b7d25205e987bb15e285e96bc4cb87ab3d7ab41d0e0511d52c1a299cf0f0a6d6cf0cdd1e2123171207ba7598
-
Filesize
1KB
MD5ab8382cde48301504f44a1a32405deed
SHA1d1dc6509881f463099cff0c1b7b41f1778cfc2fb
SHA256baef522347cac74809cabffc8fab689bd4e1a336a51f439ab5897de29fe757ef
SHA512db8e2e73264a36157fb1cc7bf96e0242af2bf463b17c6202e4d689f67594a89882d6a9bb00b888c700cd754cae8dae63485f60e3c3e6ca68a84c4f49f3bd1f09
-
Filesize
1KB
MD58f9657a281297075a67fe22294f36115
SHA1e42cfb961fc6207de59be29889c5ac3f44bf65b3
SHA256e9817664cf303b98b4a114ff1a789acff01988f3058f67c7f8a9f3dcfb88b190
SHA512239ec97b7f941e767ef93d1ccbfc902bdda6199686f38de33252b1fb32b2f680eb909fe3fc66fd1a52717bec9c952cfc7616b06f5e03ef81c007b830b7b82efd
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB