Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
19/07/2024, 20:15
General
-
Target
5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe
-
Size
22KB
-
MD5
5d812358801d4432d93b6f011bcb50fa
-
SHA1
0e1c37a6e30742c6e9ab732d8a06b65a430bfe45
-
SHA256
d59216a9de9fbdc8301dc10f2ae52e975852b69ae11c34b3e5ae4ee8c81affa0
-
SHA512
605940292a2bc1d768c7da6055267b23f6647394ac998f402f21e2fdd0f379e465cfd791f6afc30b4ea78dee8b9fde700d408cddfb278027b0dddb2effd89262
-
SSDEEP
384:5tp91uLhedOZ373w+uTmYeCqLOvFc1qBt6zHLrYqfou6T2hhCY15HXfG347:rp91OOg3bYTmYRBQL8q/m2hMO3z
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d812358801d4432d93b6f011bcb50fa_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD530fd1b3a1af50ccebd52874307794903
SHA13d770b15d3c94bd3b12bfec78c386fcbb0c22515
SHA256e5e7bc1dbb6ccde2fe0f58f3cef9cfcc87bc6415bd5c2a239ef16109f7a1ff00
SHA5122ae8fb7ef6342858bd8e1ca9223a2e6765c63f1ac63b368edeca9d9842b8a2c0413fe921290d09f16da5b33d0b622b834a1bbe00f50943ba529141fa9736a1d2
-
Filesize
108KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
108KB
-
Filesize
76KB
-
Filesize
76KB