Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 02:57

General

  • Target

    188a2c3e71362cd2f58ce35ecf0bc098_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    188a2c3e71362cd2f58ce35ecf0bc098

  • SHA1

    25d26a92801ea7df26d76970c33366a4b2dcb00d

  • SHA256

    95abdd08edd92b38e348f7fca5feacc00d48c3f114351d570e7ce5a860e0fc20

  • SHA512

    93b47550481459a68a4b6824d61d3756e2b39419e0151f2ea37bd980036d8e39d76314aee89f46b72ba784b3eee7282df62f03496b73cfb83dee85a5b0abf818

  • SSDEEP

    1536:B/yjQT9FaW1wXzX5td6U8LHJRsV2OoBuuz6:BqQT9IWeDHcUoHJU2Oa9G

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\188a2c3e71362cd2f58ce35ecf0bc098_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\188a2c3e71362cd2f58ce35ecf0bc098_JaffaCakes118.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b