Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
01/05/2024, 03:15
General
-
Target
0afce07272e60d392f22e5f18fd3aa83_JaffaCakes118.exe
-
Size
6.7MB
-
MD5
0afce07272e60d392f22e5f18fd3aa83
-
SHA1
a2adc4c61042ac4e6f3bad4c88843b43241c5159
-
SHA256
5383522cde8fcd7ec7f9601319d465dafee7e41a687dff68a551a80fa712f6ad
-
SHA512
e117db17661be2421681e6abd16184923a15a0defbf28e2878ea9e12ab93978e92ec22f2c463aaee47ea69de91bdd9aadcbc127badf9bc33267754e3fe3037ca
-
SSDEEP
98304:LP4F7Vm/wwmGno2ZzypuGe5VNGr8EBnEZVueBfwxPv:0jvwFzZzb5er990Vu+Av
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 5 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0afce07272e60d392f22e5f18fd3aa83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0afce07272e60d392f22e5f18fd3aa83_JaffaCakes118.exe"1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
12.7MB