Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe
-
Size
6.6MB
-
MD5
1567d4d5258ec657e95c11f74dee201d
-
SHA1
683ab321b13930bc949dfcf13e96a86c565ec949
-
SHA256
d881381936bb95a1cbc5621d6ef5907e525fc13347cbd5219f0eeba0f01be0a0
-
SHA512
8d4c2030ec726a08b414afcd737d31b31158291bb7f84842cfd4f0090872c1c22275ad51cb86b54d30ce2e868aadae3e453d4af9debbe5144758fc90b6c9a354
-
SSDEEP
98304:PUKKmD+eNwfUbXkfUbXCfUbXCfUbXtn9TBfUbXX:PUKKAwfUAfUefUefUhn9TBfUD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2012 _v_2248.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 116 wrote to memory of 4032 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 86 PID 116 wrote to memory of 4032 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 86 PID 116 wrote to memory of 4032 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 86 PID 116 wrote to memory of 1484 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 89 PID 116 wrote to memory of 1484 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 89 PID 116 wrote to memory of 1484 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 89 PID 116 wrote to memory of 2012 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 93 PID 116 wrote to memory of 2012 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 93 PID 116 wrote to memory of 2012 116 1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1567d4d5258ec657e95c11f74dee201d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del _v_*2⤵PID:4032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del /windows/../../../../../../../../../_v_*2⤵PID:1484
-
-
\??\c:\_v_2248.exec:/_v_2248.exe2⤵
- Executes dropped EXE
PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.7MB
MD5ce1c6fb2c11587d8dc96443976c28615
SHA12f9d9e930c7887bb91f81aa08cf6f0d2a5b379a3
SHA256ae829aa99fadbdfb600036d92cb8e3a15a74ef23af966bbf73d596d61bd73203
SHA512d243a22501438510a0d4b325af35427de60d80b0f5d65340437e251ca04f3e683a2d1931567c0d012b748bdd3f4c7d28280bf9b931a19e5ce6670f0ed0e54913
-
Filesize
6.2MB
MD5a66886e18b6e0f2791ab5dd7468962cc
SHA19b22b07f8899164043ce1d6ee304205384a2e872
SHA2569ebfd4e3452dd26d569a1433b2dfa8a0bbd1de26ce561821911677e62b658a87
SHA51212d9f44af72ce737d8d1bb563e64c0af9bf5488286023d7fc35544d1deab03f7eafb254e9eb966520ff1637b1852defcd1596d869e3ec20c1edf7a66a8104d31