Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/04/2024, 16:23
General
-
Target
e7e489a313cf6f85441e789af5bd6795_JaffaCakes118.exe
-
Size
784KB
-
MD5
e7e489a313cf6f85441e789af5bd6795
-
SHA1
1b6f26faaaa14bc26594d251655fdd159ab42b4c
-
SHA256
e61a7c609fb77e3001bdde0a14cc7db904c51456b646d6e662b02c474737edfb
-
SHA512
92797a05d0461395479b0437ae28dae55e067eeee64ec9db447cd4c052ee4ce9dc13101bad81fc4ba70708e18bf6ada8280d168330bfe0244b452078e2742d06
-
SSDEEP
24576:S5BoF1ppGWWLPVlIktvUFJt6BS42xDKpUBQ:6BoTTaql6wxDKpyQ
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7e489a313cf6f85441e789af5bd6795_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7e489a313cf6f85441e789af5bd6795_JaffaCakes118.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe c:\windows\system32\e573642.dll, Launch2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
513KB
MD54cec0f865ffc98161d1e01a14e286546
SHA1dec6c9239c9a2d26956e822a4945660de3487220
SHA256e46a8832958cfd75ed5199978cec334b4b61ea6320d9c4791d1649a54c18df06
SHA512d84c7df3a2c5bf553fbeaeee52e60f4c1ac2807db75372ce9795ec8b466eca998831ce7b1806dfb210f89ed571e37b2d6aa731e8319ceefb7a8746c306db0473
-
Filesize
256KB
MD5a3797f05474cf3c0d0f230d0fd166b1e
SHA1bbd1a4a85f62c0a03fbdf2e0b408c168b2f2538a
SHA25611edb5aa4d4011419c936e5edce8297c7fff3a303b42575e5520021630d74151
SHA512ff111746470cce2ff1a436be584e38b786cd749b9fcfb1bce32832bda9c0086fe9d61f4551628f30d74d358c42f50384b757232bdaea002c3d741cffa28248e6
-
Filesize
248KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
1.6MB
-
Filesize
8KB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
248KB
-
Filesize
248KB