Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 12:45
General
-
Target
34c7259db30d7a03d2e33ba8d7f915c6_JaffaCakes118.exe
-
Size
408KB
-
MD5
34c7259db30d7a03d2e33ba8d7f915c6
-
SHA1
a54336f8ccc4fa0f74d46a25cd587dde8e40f18a
-
SHA256
f27d941a91c3c809a07aa6d3312a3ff98370ff2286ed9141ae71fab8a0b581c8
-
SHA512
a5ae1bc351aafdd24bb1b3e5c21b07128381b076f9bbb864e7106c3379969fbb107d8754e0e950f17eb81a4dc751c20eef7789d962e0c91c3ed0325404110526
-
SSDEEP
6144:23e9whpxK+1bAo0xGvF2idZecnl20lHRxp3galk9ihl0/srEQpPK+e1FtEuxF+Uh:23Y+1MoZF3Z4mxx1oEtlK+kt9T2M7
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c7259db30d7a03d2e33ba8d7f915c6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\34c7259db30d7a03d2e33ba8d7f915c6_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PCÃâ·Ñ°æ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PCÃâ·Ñ°æ.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k WINS1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5e02d478a305449ed4280b0b6d2d402dd
SHA19d7e580d64271d4a3c3e8ab4ca27f02da2ab8700
SHA256224d0b1a071c19ce46a50ca11f53b44fa7023621903b7ba71edb3acbf49ed510
SHA512f786c638b16a7edc3d0894a1961ad2e04e1af59acc0913e9c2df198915e645e07ecc3818b5fbf11aad8321d3fc109b542a21355cbf5225946716313eb120fc69
-
Filesize
89KB
MD5c840cce845c01454c7d271a8b753f450
SHA178160ede1831f36abdd5d4a6ca81b94ff0e3a211
SHA256c18e544b663dddc8c0b7394709736ce6b2571f6dba8da9be7549d70c5ebf67e4
SHA512f1da3c7dd7fdb723f0d4f006308e501e0bf4db9a001f1faf4f7f99b57c0bb4c9d9395d63bfdde1459ffda6bfe48d6c103d2a5f1c5cd01a167bb976515f3d0c7e
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
552KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
552KB