Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25/06/2024, 13:15
General
-
Target
0e35d1aa1cd581494bccb286d0c9adff_JaffaCakes118.exe
-
Size
920KB
-
MD5
0e35d1aa1cd581494bccb286d0c9adff
-
SHA1
1099d1119361c2a5f4867bcf16e2a25d4874db7b
-
SHA256
69e885cae86457c4a4b21095555cd0906ff22dfc34b65b0b45b633aaae30dda7
-
SHA512
00b0fddcb97dfead478d227f6d00334ce308ab6ad40ef1e5b90db8cebe121f059e2bfc649e819339e5b66b3effe458aef610df784d5f665fad6b912395ce93db
-
SSDEEP
24576:KeFDHYvmR38IJS7kF6lDJqLGT4RSskUMFiHYrWMj3:7FbR547kQlDJqDzHsl
Malware Config
Signatures
-
Drops file in Drivers directory 11 IoCs
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 10 IoCs
-
Loads dropped DLL 33 IoCs
-
Drops file in System32 directory 44 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e35d1aa1cd581494bccb286d0c9adff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e35d1aa1cd581494bccb286d0c9adff_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1424 "C:\Users\Admin\AppData\Local\Temp\0e35d1aa1cd581494bccb286d0c9adff_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1444 "C:\Windows\SysWOW64\svehost.exe"3⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1468 "C:\Windows\SysWOW64\svehost.exe"4⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1456 "C:\Windows\SysWOW64\svehost.exe"5⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1464 "C:\Windows\SysWOW64\svehost.exe"6⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1448 "C:\Windows\SysWOW64\svehost.exe"7⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1440 "C:\Windows\SysWOW64\svehost.exe"8⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1480 "C:\Windows\SysWOW64\svehost.exe"9⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1452 "C:\Windows\SysWOW64\svehost.exe"10⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svehost.exeC:\Windows\system32\svehost.exe 1488 "C:\Windows\SysWOW64\svehost.exe"11⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD5a262ff7ed9962d5894827ab035e73b3e
SHA1791e0327fbe0d686b664e07c1f763c8fb43cd8b6
SHA256a6aac4e14a1293e9668a7c2cf503800b8f4ef51f1961c388950a7c295d1f09e3
SHA5125ed80f360ac81026dc76f4a96a545f3268f032451e78be93bf8b5d636a1e4553913c0acd3781cdcf0560655e5536a9e1788a9d69b858660c14ed41079067b8cd
-
Filesize
103B
MD55f2e32fef5b82c1ac7adba825a9446a2
SHA1b1d189c1dbe62fe5dc51b0531f64f705e949aad3
SHA256f3aee381f30accc44818e763fee8cf622a12f884f85f95c8185b472e6aeb6f81
SHA5129d0de072c6c9ebe32bd911fcfa6a838953229fbb96d9b905e40d88ac7359ab49d697bf446b7bbd6ec4eded53b07255089ab0d238ff4e5d26e8385d79b8857e08
-
Filesize
103B
MD506b39d387b239ada0aecafd2efdcb8ec
SHA15955cfc3f918361c3cbe83a897bc122d96df0ee9
SHA256136508427ca385b7e0f9567fe0991258a4c6ce0eea3695006e7212963266f9f6
SHA512ed0624a4ab8cf5a0e15091c8f33b0c6d9a3edfc13d24c38bdc4e20df3f364fbcbd8a071487404212efd4241129e2cefd77861375248f69ce2177ebb9e4b81cfc
-
Filesize
103B
MD58bae03c16d831c603a3f2af62d4d95c3
SHA17b8a6e4b7958c0f7e744a38d4e4a3064bc7e0d71
SHA2569461e7e5e4500f678d31eba485d899bce29d1d5f51a69f6c0832b1aecebfe682
SHA512beb3fb7bd8eaef2b587d0cf1f03c969802ab64513a9a189617372c0a1c8fa5d0e2954583179777c0a871592b3f746f807a568ba3fe7fb388f059b9651a70868d
-
Filesize
103B
MD5eb3faca3e8d40f42ed705c0d15222a71
SHA1ebf3d1dd3b74368b61cc945e40da101f2ce4bbe7
SHA2569357ce8cb7fda01ab41f76b550223c5e32fa9feeaac6352f513b67d1f7d41f6b
SHA51295637b5f43cd9d78a0c74e09158f77ddae9893ef303d7101f626613d8cb2688a544ae50dcfbfa7a0705cfe3e11af6c1be42b1218815bc0e4652a846d5d687c2e
-
Filesize
103B
MD510b91e005bc6f7b929c572b267b984bd
SHA1b61143e42938fa71a1aa8973d41098c28fc88824
SHA25663a61eb39b995a4f5598f12de590ccc85186c9c9caa22663639a1bcda2ddec20
SHA51286b9bb616694d409a84c464df98aaafe7272d8c5205786df4ecdc9b1c8bdacecfcabf21ec1823013a1277c2b825d0e950e5182eb178b9397e6a99abe8d64a6cd
-
Filesize
103B
MD577fb4890bd7958cee8b79a485ff644eb
SHA1cd8045f4b98348f16f0d868154fd108db803a79c
SHA2563bdfcb8926dac68c3027a4172b94764f28e4e494a43d72835fae53176b7bb767
SHA512c5a8a4d8cf57d80f438c5bb301eac39fe1be5071b760ea48df91564695f87eff10351ede69aafa61ece26e4c45c40b4ccb5b04b6e09345bc334213f5b38a9fa1
-
Filesize
103B
MD54d31eb933ea068739f4f83d86a110321
SHA1d1ad770f96c1f9150cff73849963e71e280ba03c
SHA25613af62efcc11032556ce939312d836f9ebe5da25a0ab0bccd9178cf354fe1a76
SHA512cb8f1dc234b65becf63949a0d84910a7611e41e24b575856c111c56fdd36a516aede3eb1d8d9cf01132f037116f4ae44a7ed4797e08341acb177d371bc395de1
-
Filesize
103B
MD5f08d21c7b74c21069008bad58bc5f4a2
SHA1989db1e2315f6a132633342f573eab3390731b24
SHA2567e1a51c1e4e9f5db838d3ebc5ee3f79f782d109bd9fe4facc0424d1e15b8242d
SHA512370c48d7cba7fe3a72ed3692daf73cd0fc827d8574444993855c56791ae0e5a010996a565913af0a7f812b867fbdfebef37edda308f0c5a3887329a40338f8a0
-
Filesize
103B
MD5edbb504c89d700bff1b300f0b9450439
SHA15b83a9a74032b79d135bf095fe8521cbe0539958
SHA25690bbda80d1ead9739030315ab4e98b548334a24e93ccdc05f1783ba11ea76280
SHA51210db16906d5b73d31abb8033d2e64b064540ee19a6ad9e0a74ff512bcf240d3b4c6a3341a6ed29783c0219ce4e5af09aee5676f507e5b7a73c0ce92bb6a21db6
-
Filesize
103B
MD579b6e7de1c96855c760ac15ff6d6621d
SHA1eef91f39e48f1425648d5f84ffdee08e96979005
SHA2569ba0c8c72a6aaf84850ba44ecea1ce5f2d646b12596c0723f463b636b3fffdc9
SHA51272ad690d624e34a4debf1240aafb477a49e3b4b8981beb2e548fee1024f362e4d8b69c45a3dc252631bcfd5a48907403ccf8b5eca4e660a1cb2a31019282b33c
-
Filesize
103B
MD587eaff9e29534ca0a65322dcd22567d3
SHA1be51a770e977600bd1171d1bf1ba3f5e6610848d
SHA25668dcf36d5806bdc998e67de071ef6381f846155bde7163695cf09a2df4789bf7
SHA5124eaf87a721fb8a55c9a4aaf74fff207c024034a7005822fc5debd1ebefd27b206c9751502d69172bae5f0675034acede5ec2b907a22b5efa8577ad4aeca01f33
-
Filesize
103B
MD55d4115c7f540a8f1ac548129f11b67e4
SHA1fced60e83b8507b73b9a122cb18d93dafab718e0
SHA25682f866eec5ffb3813ea6f9ec8e9cb822d89ebc69e72be3f1539eb9e0e0433f4b
SHA5121ad8c8b1c0488063e30c32aa45fd16f2b190f6723272309c7fcfbf0135d173f033ac3c2baabde6fd9f6f4fc39a75f8d13fe65092eccad021cdb4e9feaf707e8a
-
Filesize
103B
MD5b4163dba9904c1d93ba3ec4f2391b4a5
SHA184313422c428017ba816bb9257f7e71336bbed98
SHA2561d7a11819a831dc547b880af422b9ab24d08ad1593c8b15f4d448780f99042bd
SHA5125b6d8a5f417c26ca8aac2bb194d3278fbf9f3a00e4d8cfd2b546c1d799564ffe1c1d1e459ba8732fb88adb92828df664cc05275b13e449aac55b882576756fad
-
Filesize
103B
MD568445ca458d83301d3bc0bebb74a630e
SHA1bfc7678b0045ceedac3fe33cbc7f08387ee4b894
SHA2562d318365f94592fd9d611a22bb299d226fae6b690126cc2ffa1cea661069e9d0
SHA51252c90abe86c336e4c713b8ec04500ff1bea97a6825228d2387c95dd6fd2652816cf3223851f58b90ba3b62f7b298ceff2b5fbf4c29d6447284177abaa12caab5
-
Filesize
103B
MD53642b3a3de0b0229b690e8a026f6c929
SHA1005a563d6249c06470374882c79732bd0609cb3e
SHA2566d571ba01988198f4f795991c70f9cb976da56fad66d2f30ec86869a8ec0088c
SHA512f7322ebea7b37e38d144594c41ef4db94161403b4203a91b780ffc32363f2ead5a98aefa5490f1624e789ee23f42a945711b4e7d1d25f7d44dccdbb9424c7330
-
Filesize
103B
MD5cf0ef82c54a201bad4cb8f3237eb0116
SHA190fc4cc545b2abe55a8f171adb44e92cb47dbd2c
SHA256ee755c801b50c1de95fb807f0f64b8feb4793215734b508fc172987d0361b5d5
SHA51299612585c0c87d03a3d0d6637dff3b566ea6a6d213114ce7a4ff174c9000f7dae8e7067aac67c51f6ae1778065cb75fe6a843e9a1307923b352ceaa413773eea
-
Filesize
103B
MD5c848565d55bf26d47f0f2f97ee61aad8
SHA1c0ee8001d5462fd84d37caf1aaa9dd6e37bbe680
SHA256cd3f3c99c45b218c9b6d039418edf20f9c2fecff64387942394960d1fdcdb795
SHA5128ffc716c560f90c1abc8000ffcd20c06fc9c77ce5b966f4e5013c8ec2ab0f3559c0feb1e4cb8d1db49b59aac4ebb7e4fe7adfeca537c1254a7460dae05f551c4
-
Filesize
41KB
MD5243126da7ba441d7c7c3262dcf435a9c
SHA142616f7034c0f12e3e4a2166ebe082eb3f08223a
SHA25680d36efd5b3abb82c421149d423e5019c21f203f085ae2655429a44bb5a9f5c0
SHA512f5539774d89e8f025da97e7b49d143b7224fcf899db967a34445de70f9228ea5e2d5daffe6444492ce82a3dfb2734786e09140277c208ec1e64580ad74883e68
-
Filesize
86KB
MD53eb0beb8e318646104362537570fc6bc
SHA13cb48ea9073fcca5835adad307e14ebf0cfe7279
SHA256ab3f8c80b85aae70f89c8e7919d7dd147c2bc3ec68769e0bdb05fcc4083e3643
SHA512db5fd16749641de6282d36af7b1921f908850ece3429ffe5ad33d990431bf4990f0314d28af082394af1f4d66516d9d89806a38e2801c34b4dd1ccb69bfafe47
-
Filesize
920KB
MD50e35d1aa1cd581494bccb286d0c9adff
SHA11099d1119361c2a5f4867bcf16e2a25d4874db7b
SHA25669e885cae86457c4a4b21095555cd0906ff22dfc34b65b0b45b633aaae30dda7
SHA51200b0fddcb97dfead478d227f6d00334ce308ab6ad40ef1e5b90db8cebe121f059e2bfc649e819339e5b66b3effe458aef610df784d5f665fad6b912395ce93db
-
Filesize
234KB
MD5cb0afba4f0fb6ca2b2ea0d2c3e86b588
SHA12459367892e012314b451e05de1f1162448a05fa
SHA2561b0fe60175c88f7cd3f3765b2f0f3eb1530b2e5e5b51f89a83e0322de32bdcf7
SHA512a4e2d66af68dee67be5883c4770c1339b6be4847a993619389404af6a7ec9763361d9a14c632ca6704f63d84b05483f4bea2ec035b466fdaf03ce68c5cbca128
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB