Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe
-
Size
86KB
-
MD5
4a4d3b0550bed4ad33bee7ad6795e536
-
SHA1
fd61d9e5801125227811147b6ec57c349cd6584c
-
SHA256
23715fd798623d2b40bcd81e462bf391737daae2f5dec30409ade8cdc7cba4fb
-
SHA512
f39b79801e289489cda01ed0d11471393fb313c7cd1da81702cc4bf48aa70637ed915b20f16b49af3da9f137e2998df6f40878da161dcda413c9eefc9ed60e8c
-
SSDEEP
1536:IutIK1iOmsWVSl8q0Q5Te2liSsAHXZkPN4UUlPtg/Ml3G7w6qPX5eJxGNJ+1:HgxdQT0QU2YwXu6blV4Ml76qfYJxG61
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4392 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4392 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe"1⤵PID:4748
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x5141⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392