Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe
-
Size
460KB
-
MD5
3a75ad36745a128836896eb0ac1bea80
-
SHA1
0b9c0364ae194f2cc75e05c29d26eed6e7fd9223
-
SHA256
02d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455
-
SHA512
60ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9
-
SSDEEP
6144:Ab/2Sw+oJEdJGpT42yoW4RYMnlYnnzsEpPRvutJTtgWfOiMY3NewDyNYu:6kE/O4OW4SkYnnzlptuzhfOg3NRI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1480 ppzltcqvggths.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1480 ppzltcqvggths.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1480 ppzltcqvggths.exe 1480 ppzltcqvggths.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 220 wrote to memory of 1480 220 3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe 82 PID 220 wrote to memory of 1480 220 3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a75ad36745a128836896eb0ac1bea80_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe"C:\Users\Admin\AppData\Local\Temp\nrrrddagftwsk\ppzltcqvggths.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1480
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD53a75ad36745a128836896eb0ac1bea80
SHA10b9c0364ae194f2cc75e05c29d26eed6e7fd9223
SHA25602d33c5d52bc209fb12fcf89fed736ed55a9979fbd87b4e8c9df983f5b524455
SHA51260ba9e0ceffa9f07167b0df950bd6a594d5d506bb8d2badae2ad95b8c34a16cf17712a1e89563dd686a52e46d7a9df960cd78f1f847ba85d1fc036d4c60266f9
-
Filesize
7KB
MD5e866084611bc2075e4f5e6f265144f20
SHA189e62a9c1ef200c5c35af37ec5169d6ee805a535
SHA256a69c21088dd3cc1b86be21ff9784f9d87f083bd2317dc4c8b0b3982ee187250a
SHA512c3ddbf564cfb30c977c59aa8f3e3f921e7d3cf1b934c35a22384f7eec45447cf37e25cbc12286fe26c5aed1cff856d65d08412cb5e2633c22b788fdeb9e57b86