Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2024, 22:56

General

  • Target

    6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe

  • Size

    161KB

  • MD5

    6135da252a0f6ecd2b5cd390510c9ffa

  • SHA1

    7f2492a421ee71c198dba0099ac5459aaae73cfd

  • SHA256

    4e276904a581746b4600ab7eaa6da8a6d497b1b8e02088737e31445cab556506

  • SHA512

    74317193831157b314d62ed038ed38ad1016b34069701095d50ea5c95938b24d7d51c9980c8e0f02d3eabd04094f36ba5d42306fd7d9210b7ca57e9a05cd9583

  • SSDEEP

    3072:dqnyWt+C25wRXv1fasottOWHD44lU9guWg5Mcac:xr5wRpa9Hj7gjJ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6135da252a0f6ecd2b5cd390510c9ffa_JaffaCakes118.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2644
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\disclaim.html

      Filesize

      2KB

      MD5

      ac13abc23d0a7e60750933b08bc95698

      SHA1

      8546be5e416f54b1ebe84237744b70e6e8662ba0

      SHA256

      df365f84b1b4643d88e1b5526331480dc5f0e46fb555097373808e70a86de49b

      SHA512

      5eb53f8ba1297f171f9e75497f2c27b0700d047e0e8cba6e9de9f6d4da3338bc055298a59f4927f6e0f3bcb8309056b12e0ad5d56a3ea5c6a62203e45d555f30

    • C:\Users\Admin\AppData\Local\Temp\index.html

      Filesize

      7KB

      MD5

      98c45cca9bee3a206a2aa669559bed0f

      SHA1

      bd8f11d1f758816e065ffe46add6ce6b9932784a

      SHA256

      fb7836167c59cb32c533c9a88f5280250f2c453ef5ded0bb87c2543992784005

      SHA512

      4fac1716f814862339a1c660c3d23de0e3bf787205bb0aa4007bf722278c9afb152306f21690d9368ec7f77e48ad944bbcc58313fe1014d4ddb8ad32844244b0