Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
13/07/2024, 06:45
General
-
Target
409a7cadbe439eaad85db80ac5aa1153_JaffaCakes118.exe
-
Size
444KB
-
MD5
409a7cadbe439eaad85db80ac5aa1153
-
SHA1
4241e94959e5e75b5d3337a37305047cc7d8d7fe
-
SHA256
62333ad09d48d50acc8de0316a967f2082b3bd0b6060672f76c76774b2736699
-
SHA512
03138bb08850c4374008d1384aab5562370c5b398cf99b41c303d9183abc6c624d3dcf6370b7796bd2c87c176a5c24331dc2b86bea4ba4b40bf18b96718d845c
-
SSDEEP
12288:KKbnhU1xnPjtsLGb4epMDimiZ1+ELXmT:U1xBsLTnW
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\409a7cadbe439eaad85db80ac5aa1153_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\409a7cadbe439eaad85db80ac5aa1153_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nLpNlDb01804\nLpNlDb01804.exe"C:\ProgramData\nLpNlDb01804\nLpNlDb01804.exe" "C:\Users\Admin\AppData\Local\Temp\409a7cadbe439eaad85db80ac5aa1153_JaffaCakes118.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD546c218db5a487ae38d4327706a54bfdf
SHA1339a782fc7558516f92166db1748da4f6120fd1e
SHA256ae06636e1ba948aa13eb65b74e1359baff12bc89e650b52e6692f73913f04bdd
SHA512811b944d49b28e967f5e9eac0b9dce616298985592aa6f38cf96f53ec2dd14e5fdf69bde519726a52f9eca46036abe28345e692c32dd7cb337ca21ae179e5fb0
-
Filesize
724KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
724KB
-
Filesize
740KB
-
Filesize
724KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB