Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 06:56
General
-
Target
a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe
-
Size
27KB
-
MD5
a1956b60215576f21c4dbbd9db55aec2
-
SHA1
e6c19fb44ce6a16d382b7af98e0004d26b7e6fab
-
SHA256
4cdb1f2860f0eeb7d8fddf08f3fc358e30c90dfbafb561f655d2d8d76593e23f
-
SHA512
81cc7ec0fd76dc05a4449eddc3006fb0a8710272a8ef9a868b2e1e8897ccfeb11dc22d2eb460b016da5a7ac550aa756a9de2eeaf38887f20f56251b88b197913
-
SSDEEP
768:eLKlaHU2TZniXlA2r+1PHQxkAJvSGrof1z:eelaHXtiSUSPU/RSG0
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a1956b60215576f21c4dbbd9db55aec2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5e00242fb4d23093d022467d144181cb2
SHA1d52628b7aa84bf2bbb908dfa9b1ba6be53520a1f
SHA25608c7f348de0da18007ee206de69a39645dfb033108d752b1061fb8ff21241206
SHA512ae70fc56c4582295f031695713611ff735c7935f5509c18d9054c50dbd4b64fc29f594810bf4f0904c929f296d2857153c40fdb4108582ce79358a76ad8415d6
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
44KB
-
Filesize
60KB
-
Filesize
60KB