Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 08:44
Static task
static1
Behavioral task
behavioral1
Sample
018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe
-
Size
58KB
-
MD5
018ef34852b70e7876a348bcc8ba3a5c
-
SHA1
3ff543d7bba6fc3f75d0224810f1bc67e0e5dd41
-
SHA256
206f8c20726ceedf23e5ed0177788fcbbc8e4c0ed04e673cf2c273e8bbb352f3
-
SHA512
4438da5b76fbb54212493df57ce413655317e9a9962675a7eea3b4ff948d6426e5ef654d4d3859bfe44e738907ba43d5621f81e637ec8b30753185736282af02
-
SSDEEP
768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOd:71Tzy48untU8fOMEI3jyYfPiuOd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2608 2192 018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe 29 PID 2192 wrote to memory of 2608 2192 018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe 29 PID 2192 wrote to memory of 2608 2192 018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe 29 PID 2192 wrote to memory of 2608 2192 018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe 29 PID 2608 wrote to memory of 3056 2608 cmd.exe 30 PID 2608 wrote to memory of 3056 2608 cmd.exe 30 PID 2608 wrote to memory of 3056 2608 cmd.exe 30 PID 2608 wrote to memory of 3056 2608 cmd.exe 30 PID 3056 wrote to memory of 2528 3056 iexpress.exe 31 PID 3056 wrote to memory of 2528 3056 iexpress.exe 31 PID 3056 wrote to memory of 2528 3056 iexpress.exe 31 PID 3056 wrote to memory of 2528 3056 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3B2C.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\018ef34852b70e7876a348bcc8ba3a5c_JaffaCakes118.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2528
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
58KB
MD53340c5cc621bff65fd60f703d8f519d2
SHA18b4a8322c8b27189ec5087e3ef8772b32701cf2a
SHA256b2a1d59c7ddd7d278abed7fbc75a86480930e5d6d689a2998fa178cba7e9b78a
SHA51258093b0fea140a03da66dba748a13f7b8c8807ffe4a1ee078d63291e68502ddeb7cca85232021ce87dae445a17c4d6c4ee9291f6763381800b9351a66cdd4a51
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083