Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/04/2024, 11:54
General
-
Target
e27c18b9890865b7f623cc5b4cf2504b_JaffaCakes118.exe
-
Size
104KB
-
MD5
e27c18b9890865b7f623cc5b4cf2504b
-
SHA1
c2c433770e11db18016c7b54601c69ac6657bdf4
-
SHA256
714d3e179c6935a44a97f35a7fdf794c0ca7a7aa161d140be338f6f7c5804b77
-
SHA512
4244af4fede8ace12676da47a59310aa42215463f13e11dae0637e0537e945841473a4e6ab6af710108e9206845d4e9c50e239795b7a827e5f424a8e74d3840d
-
SSDEEP
1536:/2PVJ2K352P+FFQuC18winP3QTMAqkelvkTGxvB6ijkph4tIo8LmHFMxsY:/aVUKdKxiYulvrvzQpqtIo8L2M+Y
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e27c18b9890865b7f623cc5b4cf2504b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e27c18b9890865b7f623cc5b4cf2504b_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\CbEvtSvc.exeC:\Windows\SysWOW64\CbEvtSvc.exe -k netsvcs1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5e27c18b9890865b7f623cc5b4cf2504b
SHA1c2c433770e11db18016c7b54601c69ac6657bdf4
SHA256714d3e179c6935a44a97f35a7fdf794c0ca7a7aa161d140be338f6f7c5804b77
SHA5124244af4fede8ace12676da47a59310aa42215463f13e11dae0637e0537e945841473a4e6ab6af710108e9206845d4e9c50e239795b7a827e5f424a8e74d3840d
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB