Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2024, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
1eaf599e964316c034d4026810794f67_JaffaCakes118.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1eaf599e964316c034d4026810794f67_JaffaCakes118.jar
Resource
win10v2004-20240419-en
General
-
Target
1eaf599e964316c034d4026810794f67_JaffaCakes118.jar
-
Size
1KB
-
MD5
1eaf599e964316c034d4026810794f67
-
SHA1
1230a74e348bcc91af8b0f5493af29b29b8d8111
-
SHA256
7b5467ae9d8879f9c1d51783fc2c586530670747fec54932d85e366cc28b0861
-
SHA512
3174860dd2ba85f68e49f5885322ad0ee8d7d53b26e75f76e35cc32c0b8936acafc655ed3aef567736132949c15a313f7f083aaefec5714635b9fe0cf03c9ea9
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4448 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 852 wrote to memory of 4448 852 java.exe 87 PID 852 wrote to memory of 4448 852 java.exe 87
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\1eaf599e964316c034d4026810794f67_JaffaCakes118.jar1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD59b61813b85f7068d8e28e4be2fceb7c7
SHA1d6cdf3d21e1623a21757364cf032528eea651267
SHA256347bba4124deaaef084aa980e8f3dc8f44f05cb995b5db9057de62187b302382
SHA512dfdd7f5136fdf6e7c1c767f8716b2876217cbd8a5a193e62f155b45901ffccdc4f6afdf3da06126b0e85db0adfa3793de540f191d79ccfaf343a9bf6daae68f8