Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe
-
Size
23KB
-
MD5
371e4dbda72d0f895e0a8f8d8d6c5a36
-
SHA1
5b6db96a4d759da53b3cdf387262d1cbbda944b2
-
SHA256
470551deb595b79397464c3846eaf79de6f25e22bbc35001a26f4c6c037a980d
-
SHA512
21ee4575ea271eb694772b21a60deb31313e559acc2d8d3017d587dbd503c7962116b2f9438ecb7b019bcd393949ff8616f782ce68f6e069d591f1b04b5af383
-
SSDEEP
192:1CH/QebWdQb3YAoNfkEfV6w69LrLEjPx3rRu892a+kqR6BU+MT8ItN:1Xe90AoNfDSL/Ejlduxa+DcBS8+
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File created C:\Windows\system32\spool\PRTPROCS\x64\xwSK793w79.dll 371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe File opened for modification C:\Windows\system32\spool\PRTPROCS\x64\xwSK793w79.dll 371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\spool\PRTPROCS\x64\xwSK793w79.dll 371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe File opened for modification C:\Windows\system32\spool\PRTPROCS\x64\xwSK793w79.dll 371e4dbda72d0f895e0a8f8d8d6c5a36_JaffaCakes118.exe