Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 10:08
Behavioral task
behavioral1
Sample
0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe
-
Size
776KB
-
MD5
0dab33204721f5f91dbbe561a56178eb
-
SHA1
94e65b87e818e2358198c472d942785d18010968
-
SHA256
5b65e4a70ff387b02795174a5530cf9819b4bcf3d886500d3e479498c45263cb
-
SHA512
1aa3a39467137897ff9cefeaa475ece71e95192ed90d9e4aba3d347d134e831dfa84164ef075e217fc9efc0da768c3594a7c371b2fb4e990d71a25f7c82abfac
-
SSDEEP
12288:KYp964scY6gOOjvS6tLTHDWKUJdz1a9loyRqvF7vSSl+AegMCIo9KQ:R82gJPx8JdE9lold6LgMCI
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1280-0-0x0000000000400000-0x0000000000624000-memory.dmp vmprotect behavioral2/memory/1280-1-0x0000000000400000-0x0000000000624000-memory.dmp vmprotect behavioral2/memory/1280-1488-0x0000000000400000-0x0000000000624000-memory.dmp vmprotect -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1280 0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe 1280 0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe 1280 0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe 1280 0dab33204721f5f91dbbe561a56178eb_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5e02bdc9f9f88b9dd419576ede47da279
SHA105c0be576a4cd4a343014fb0560270011539376c
SHA256fb8778260ce48026bca77b082f72dee36e014fa7017004141055d6e248fe8ba2
SHA512ff1882cf4de663267826c04d404e82db597b805eb0b8923db927bbd64b1d06043579acaeeb26217ab1efe11c1ebfda9d40cb00331c96c0197854527aa7e7f285