Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 15:41

General

  • Target

    3df76d9b1d009113d2a333d8a5ecca51_JaffaCakes118.exe

  • Size

    423KB

  • MD5

    3df76d9b1d009113d2a333d8a5ecca51

  • SHA1

    fd860fb187d45b2bd831178dc47956fab8f9f78a

  • SHA256

    eb62b223ccac728b54fa60b5bd8cce3a31fe125a7f0f72fa3b1ee5d9f9669085

  • SHA512

    e14e1cbd3eee24e793b6902916196272ffa9ec93a7c0d7326c754875d5a62b6c8070bb1aa227b2a6c56b9f7c3ab69fcee5b68d6c8bb7148c671f721e44314a84

  • SSDEEP

    12288:bwaA3t7VPRw+8cOSQN2jyGFyFjISvfsJJa/oSdi:kpbw+8cze/jL4U7i

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3df76d9b1d009113d2a333d8a5ecca51_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3df76d9b1d009113d2a333d8a5ecca51_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WZ04RUV6\downloader_logo[1].htm

    Filesize

    328B

    MD5

    f8dd6e7c487d032d6bcf942578dd30f9

    SHA1

    cbcf5ad43d93c8392adff6de0746ba18064033ab

    SHA256

    f084d53e50d5028ccfd8e3245f0c676cddee3837d45e8db3065e248cd6b0bb27

    SHA512

    774b23c16d69bc48cccdc8785dd68d30f3315895b095f6e052675ecfb8113be1a609c367b89cc33e01c2a7f7ff0fac7189bd44277901ceba7a7dbfbca9e6387d

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\3df76d9b1d009113d2a333d8a5ecca51_JaffaCakes118.data

    Filesize

    813B

    MD5

    c4eec8e782df2b07bb84c90112bd56bc

    SHA1

    c116a583f0fdf4ec1dd531f19ec011a118428a40

    SHA256

    63bf2eca3a7edc35fcf0634838c0b1be5c0ffa08ff3df54bfee56eda98298b9a

    SHA512

    76ce4124cd644b9c223f03818fa7c05c1dc67120c708ce67a76df5c0eabc50bfc1988d06a4b10308ea8d59cd617d130054195e875135b7b0a22fa7415415000b

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\3df76d9b1d009113d2a333d8a5ecca51_JaffaCakes118.htm

    Filesize

    87KB

    MD5

    2290e78ddaffaa73838e9a67d679cbc7

    SHA1

    5e2583a2c5bad107c82cab2a495d559e1385ae41

    SHA256

    ca6005b88259d61bfc9943b1236cd4f6f12833f3134a3c1553545247d95aca2d

    SHA512

    a2c6ae503b264e30925c685efb6389175138fb809989d5e4c61e62345662c0d7a6e0de57c6a8f883209c7bf613c6be3fb4ca2031876d562271c8b111ad338abc

  • memory/4828-0-0x0000000000400000-0x0000000000602000-memory.dmp

    Filesize

    2.0MB

  • memory/4828-34-0x0000000000400000-0x0000000000602000-memory.dmp

    Filesize

    2.0MB