Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2024, 06:08

General

  • Target

    0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe

  • Size

    3.4MB

  • MD5

    0b3a53ec25edfaacd5714245f96aa961

  • SHA1

    333634d7925abf54d204fd30db806643a22b3051

  • SHA256

    527317bebc4b27aa2bfdc72c548312bda57800b0062aa1ace6ad7fc3869afb18

  • SHA512

    a3962ddabb1799509a9d82c218d6109448c16f7499cf12a7cf05749db0e1926e4eb60c26d13bffeb8444bda744fa00a4a2e8e520789874ae6b96505277cd8810

  • SSDEEP

    98304:6Fu2QprAfsDm5Z0WCqXlU+C8AprN40Mr7ugHE:SIrAsWDXlY8o606lHE

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0b3a53ec25edfaacd5714245f96aa961_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    PID:3772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\jabswitch.exe

    Filesize

    79KB

    MD5

    8995c7bbdb321889cfcb8351d0f067c1

    SHA1

    af5f924cf254ca6f319b29f01ccd082a1a73d646

    SHA256

    1fce698dcdcb69a650be5848345a3a6e9ab7322823f0f8fe3690eccda6e11819

    SHA512

    1738be168c3876163f3e60c088e16dfa360a9a443bd0776c099198fc97f5f2f68bdc1e41710068dd18f4fe6f343e293802dfd0d876cd6a847d896be47c6fb3eb

  • C:\Windows\SysWOW64\xdccPrograms\7zG.exe

    Filesize

    3.4MB

    MD5

    374f6d3450063f3973ef83a93ec07e85

    SHA1

    ca8ed48c4762dfcc714cebdf92cd2608f34e1968

    SHA256

    cdd47d941e4775d326f5b6449f0d3e55d08235f6528c2f569515e99418d90958

    SHA512

    e7afb7429d68e88fd39ba66d771dc06e16039beffa7e0eb90863789c9c272f62250676cd7b99798af62cdc1e54142ec7bb166152d8320eb26db3fc4eb1a5a6ce

  • memory/3772-99-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-100-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-101-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-102-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-103-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-104-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-105-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-106-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-107-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3772-108-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB