Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19/06/2024, 18:49
General
-
Target
0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe
-
Size
21KB
-
MD5
0008b40754ee4ce8467265a38cd870ee
-
SHA1
b5da08863d1535df4d089287d53f86305f53d625
-
SHA256
8593bb9725bee7d82868ce21ab91ca33f364d8af97f716ec8e4521b51f47ed48
-
SHA512
edeed789aac4d85d9622ce8e50ac2b88ce63fe399de6b593f5a0c46b74f2571750c5916bce512ce2315cf92e68b0d6383f2e9d3237fdf8006a5165b0e369c431
-
SSDEEP
384:XX9PVT08VPr72i+io4Z1hPur2S9MR1MJSiwuAGA0AFuFgzt1DouWmDEW:XX9PVbVziFaDVuh9M8dwurAbAWH
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0008b40754ee4ce8467265a38cd870ee_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c cacls C:\Windows\system32 /e /p everyone:f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32 /e /p everyone:f3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f3⤵
-
-