Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22/07/2024, 09:47
General
-
Target
62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe
-
Size
44KB
-
MD5
62bc950a6e604db2c297318ef09ddc22
-
SHA1
b6a2a366acd9b781657abf9424d02c7684db13ca
-
SHA256
15e5a4a290ea856781017b00f98a0bdd0a6397da7a0269b0c82d092b41d8a1e7
-
SHA512
ee2af8c8d7112e9cb53cc56f4bf555b06bf1071df0dd112051b9089d71fec10159d2188f95d9ccd0b7996027025fa40ccb24dd7d1814c62830a87c304bf0bc0b
-
SSDEEP
384:C99fV9cTSYRGDQSXLf45NDQfr8Ke8p8RVh5RWp1J/R1M7LXqVRSGrN2HMiifi4:C99t9cWf7inbHMNM7eHfNuMiifi4
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
System policy modification 1 TTPs 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\62bc950a6e604db2c297318ef09ddc22_JaffaCakes118.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB