Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 09:58

General

  • Target

    0763b5a3cfa34e8074699ab3f4d7935a_JaffaCakes118.exe

  • Size

    810KB

  • MD5

    0763b5a3cfa34e8074699ab3f4d7935a

  • SHA1

    0766d5c79358d0a16b7b753e1c79f19dd8c4a0d4

  • SHA256

    c145af3f9c40af5a7ea1022f7ade83b8689f72df9c323c160a298fbcf15ed450

  • SHA512

    0057436bc92873619d3b349afd8edff97e0ebeabf490ed93f59c74c521b076caaefccdd04642d42c9dd8ac70507590157ad2c96d39ac2ba4a1148fb94fac8234

  • SSDEEP

    24576:hFqq3kdqciTFSGi5mTv+fnVutOl1787xEhi9lhho:HmchSGisT2fVutu1787xEhoBo

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies registry class 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0763b5a3cfa34e8074699ab3f4d7935a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0763b5a3cfa34e8074699ab3f4d7935a_JaffaCakes118.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1316-2-0x00000000031D0000-0x0000000003351000-memory.dmp

    Filesize

    1.5MB

  • memory/1316-10-0x00000000031D0000-0x0000000003351000-memory.dmp

    Filesize

    1.5MB

  • memory/1316-11-0x00000000031D0000-0x0000000003351000-memory.dmp

    Filesize

    1.5MB

  • memory/1316-9-0x00000000031D0000-0x0000000003351000-memory.dmp

    Filesize

    1.5MB

  • memory/1316-12-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

    Filesize

    4KB

  • memory/1316-14-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

    Filesize

    4KB