Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 14:56

General

  • Target

    5c6cd7c23ad94560ebc20c5f6533bb22_JaffaCakes118.exe

  • Size

    52KB

  • MD5

    5c6cd7c23ad94560ebc20c5f6533bb22

  • SHA1

    0ca0793f9ae9261f732968fdb242f6aefc76dea1

  • SHA256

    5155a9da683395810fe732bb687402bc38ab23882b815b23d5e4af261683dcfb

  • SHA512

    951c583e8273adab555edc56c59bfdff701f9d249d80a0c584bdf1aacf125172a78d443f90094e105f7d6673963d8f38fcd89a0011fbb99fb57559da783c6afb

  • SSDEEP

    768:dPJ/fAQ7fQt3lHw1ytyaFc9CfS/Lqx1lLx37IWke:dR/fAQ7Qt35wfaCkF7Iw

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c6cd7c23ad94560ebc20c5f6533bb22_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5c6cd7c23ad94560ebc20c5f6533bb22_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:1060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\2nd7ewn5cu.dll

    Filesize

    32KB

    MD5

    053d86c36ddf83e948a37cd3d9a5b583

    SHA1

    501e32a64098cc62c74811c13ec79bb7718500ae

    SHA256

    a04f602c10f45f67023e2d1ddc675df344580461196c6ef712d96ec89777c7f7

    SHA512

    644b109df1a174998f77347ee23d1cd290c22742ffdb57199b1c66c59ae3cfe863f360fdb7cf12c6aa5c544bf888a4ec0eb30519cb5317273587fd0dbb674355

  • memory/1060-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1060-5-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/1060-6-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

  • memory/1060-7-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1060-8-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB