Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 04:34

General

  • Target

    fe71f4041b00ef33eb161b0585554fa6_JaffaCakes118.exe

  • Size

    192KB

  • MD5

    fe71f4041b00ef33eb161b0585554fa6

  • SHA1

    8736dfa6521074a3cad7c81d4f9a158f85defe6f

  • SHA256

    28f7098aa5e076de4439be3e54b2e180520355781c901efe92b8d246fea713ad

  • SHA512

    2eebb992989c9d3a1d597fcb0dce58242f86b8fb9aea07e5b00d0bd347358d24dfb5cb15ef892930ca970dd2f8bba2d09ee27db5622413a4e85fbee8406b5e23

  • SSDEEP

    3072:5H7UYXsorkTUt6gnK4b4Nkf1JCbWWB7gUJ7kRYXsoD:5HIGrkTUfoNkf1JCbWI7gI7kRG

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe71f4041b00ef33eb161b0585554fa6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fe71f4041b00ef33eb161b0585554fa6_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\drivers\etc\hosts.pre

    Filesize

    339B

    MD5

    ebc62c617791a25dd3ec0b005684df01

    SHA1

    28a826346a42e42a864d55b269bef629c0e6fdd2

    SHA256

    9a3c603d2aecccf67ff963a94b749355d92bb570277ef5e0bade3e86585583c4

    SHA512

    65456bde27e1a22c5cfff4e5ca419d33af778edeb1c5844b3d8d02a7319df7300e6653f449dcfe17d1a3171770b7f21c2b612e21ff02c32d148e5941deeab9ea