Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16/05/2024, 21:18
General
-
Target
4d0fc92793a9bc4f988175da785cab6e_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
4d0fc92793a9bc4f988175da785cab6e
-
SHA1
1f1f18bca58f6ad56d26921061365a5998a79d85
-
SHA256
101d5cd6054970a4f418041e8043058b055bea7d71259f57ed7cb295d4cc1e68
-
SHA512
88a2fb5815e709d7cc88ae199e7fd6318720090c9437cdb35a184a50be00cef93f7f8d982396a6d1a22991c55d59f2658d0ac23b8f066ef97e427b6fc4673ca9
-
SSDEEP
24576:MWvknOMEf8RFG3+uNbocM/jrwpdQvX7pby4rENOA9bU1pQb+g:MUeOMmtu//wpdu7pu4f1O+g
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d0fc92793a9bc4f988175da785cab6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d0fc92793a9bc4f988175da785cab6e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a2dGo5CgBO\zyhNGhs6\Setup.exeC:\Users\Admin\AppData\Local\Temp\a2dGo5CgBO\zyhNGhs6\Setup.exe --relaunch2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1316,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54d0fc92793a9bc4f988175da785cab6e
SHA11f1f18bca58f6ad56d26921061365a5998a79d85
SHA256101d5cd6054970a4f418041e8043058b055bea7d71259f57ed7cb295d4cc1e68
SHA51288a2fb5815e709d7cc88ae199e7fd6318720090c9437cdb35a184a50be00cef93f7f8d982396a6d1a22991c55d59f2658d0ac23b8f066ef97e427b6fc4673ca9
-
Filesize
1.1MB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB
-
Filesize
1016KB