Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 14:12

General

  • Target

    f82afb6bb2a0952fb046a7034f0f4a19_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    f82afb6bb2a0952fb046a7034f0f4a19

  • SHA1

    544058930ae57813bc542b2926e95583a7660ff8

  • SHA256

    bb7a035e39415e0f758972b7fb06985244e10fc7d4520fcd493d0083fa7716ab

  • SHA512

    10f0a9bc2332077f2b16c2cf54a03a2641530dba236d595d566ee29b4c1c483d06ed89e509b1c54c513526f4c471cfa926a6c65e8609bb90432fd6d702d4fbdf

  • SSDEEP

    384:YcW5oOd7Jdu7xX48ylS9vDnrGlp6KUkqOaqKWM0UICGS/WsJJyW:X2jd7Jdu7x6AshC2j+

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f82afb6bb2a0952fb046a7034f0f4a19_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f82afb6bb2a0952fb046a7034f0f4a19_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4056-0-0x0000000074F80000-0x0000000075531000-memory.dmp

    Filesize

    5.7MB

  • memory/4056-1-0x0000000074F80000-0x0000000075531000-memory.dmp

    Filesize

    5.7MB

  • memory/4056-2-0x0000000000B90000-0x0000000000BA0000-memory.dmp

    Filesize

    64KB

  • memory/4056-4-0x0000000000B90000-0x0000000000BA0000-memory.dmp

    Filesize

    64KB

  • memory/4056-5-0x0000000074F80000-0x0000000075531000-memory.dmp

    Filesize

    5.7MB