Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

0fc9c26fbb...18.exe

windows7-x64

6

0fc9c26fbb...18.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 22:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    0fc9c26fbb31da1172fae1b669414d02

  • SHA1

    3e7f3d658ec3e9d64159d973db252092f0349bd2

  • SHA256

    1c64bc65afb39f783ecc9dc76124aa306e5c690e0e955268b7c456551e2b4bc8

  • SHA512

    bceaa1fd75eef3390478b526dd49e2db7545d896b910060921251ac9df1030a1e9173f6c0c6a3681ae6b5a820a547c895f3ef35fe4842dc7fd0f3f2ffba52a14

  • SSDEEP

    3072:KsoKKS5ZaWAcv+9e792oC+JsrznsomYVAPcqZq+A/o2uFHoUupCb:poK1aYj79bYntoEqZxAEus

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0fc9c26fbb31da1172fae1b669414d02_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1872-0-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/1872-1-0x0000000002030000-0x0000000002053000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1872-3-0x0000000000401000-0x000000000040F000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1872-2-0x00000000020B0000-0x00000000020B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1872-4-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/1872-6-0x0000000002030000-0x0000000002053000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1872-7-0x00000000020B0000-0x00000000020B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1872-8-0x0000000000401000-0x000000000040F000-memory.dmp

    Filesize

    56KB

    Download