Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe
-
Size
45KB
-
MD5
139cb7b5f357a3ceb8be8b6e49d95491
-
SHA1
8acd6857aebc94b00f966a291b0b5c8fb6daf1a6
-
SHA256
90d7603e1ad56c35bf268e2a7035b9f2e3158ce284521bd07658073c22bd81b4
-
SHA512
240d3ba1866033e072069f0cc757c67a4d3861de605270ba8cc876c0aeb3ac0f7dbebcebe282e1bf170c873b56c3183962b79aa20884cd241c4dc246c10bb2ce
-
SSDEEP
768:GSNMqQyeKQOLnZT3CIH2ys3YaVRIYFqqGnoQBlT4XA+qnBdkRN2+6dXxcjbFK:RNMqVeKQYnZT3vWy0YaRI8zA+6Bd+N5D
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe" 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe 2332 139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\139cb7b5f357a3ceb8be8b6e49d95491_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Impair Defenses: Safe Mode Boot
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
PID:2332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58733192154d6eb4bc9d4f5e66e27bfb4
SHA1bedfa1e6990f7d588297e520ad7eaaf39ea3f027
SHA25609ae95e5c4c699346075ed8d95c7b080bed5f121f839ff6801fd3a3407c5aaef
SHA51267277d3b0a9e2c4ddaff19779b3f653b029059bffc23875849c02c852c5cf124b2ddc177dd71f9ebb815c4fa99b5a87f9f6c33081372108e17fbc31ecf7e2266