Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe
-
Size
20KB
-
MD5
1fea9b86854ca0ad9659fb949161780a
-
SHA1
deea484161c46539ff0fab83957bcb70827a19ae
-
SHA256
1938427566a51a0bae87831b42282ae67a166a2c6ae81c1795a2d789bead4ef0
-
SHA512
8b0b273f37be02df018a8956ba2e3d4e6079c5a8c755386fa8636b558828df69673e948726d7d45c00a2c56e1562ad863800cfd9a5ea55ab31466d6424a0f8c1
-
SSDEEP
384:hdtXWiJCQxsEwvK3RpSSHuGQG2Rqm4YhYQMx+L41gS:hDXWipuE+K3/SSHgxmHZ1H
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2928 DEMF6C.exe 2948 DEM64BC.exe 2888 DEMBA0C.exe 2316 DEMF9A.exe 1564 DEM650A.exe 2880 DEMBA5A.exe -
Loads dropped DLL 6 IoCs
pid Process 2004 1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe 2928 DEMF6C.exe 2948 DEM64BC.exe 2888 DEMBA0C.exe 2316 DEMF9A.exe 1564 DEM650A.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2928 2004 1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2928 2004 1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2928 2004 1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2928 2004 1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe 29 PID 2928 wrote to memory of 2948 2928 DEMF6C.exe 31 PID 2928 wrote to memory of 2948 2928 DEMF6C.exe 31 PID 2928 wrote to memory of 2948 2928 DEMF6C.exe 31 PID 2928 wrote to memory of 2948 2928 DEMF6C.exe 31 PID 2948 wrote to memory of 2888 2948 DEM64BC.exe 35 PID 2948 wrote to memory of 2888 2948 DEM64BC.exe 35 PID 2948 wrote to memory of 2888 2948 DEM64BC.exe 35 PID 2948 wrote to memory of 2888 2948 DEM64BC.exe 35 PID 2888 wrote to memory of 2316 2888 DEMBA0C.exe 37 PID 2888 wrote to memory of 2316 2888 DEMBA0C.exe 37 PID 2888 wrote to memory of 2316 2888 DEMBA0C.exe 37 PID 2888 wrote to memory of 2316 2888 DEMBA0C.exe 37 PID 2316 wrote to memory of 1564 2316 DEMF9A.exe 39 PID 2316 wrote to memory of 1564 2316 DEMF9A.exe 39 PID 2316 wrote to memory of 1564 2316 DEMF9A.exe 39 PID 2316 wrote to memory of 1564 2316 DEMF9A.exe 39 PID 1564 wrote to memory of 2880 1564 DEM650A.exe 41 PID 1564 wrote to memory of 2880 1564 DEM650A.exe 41 PID 1564 wrote to memory of 2880 1564 DEM650A.exe 41 PID 1564 wrote to memory of 2880 1564 DEM650A.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1fea9b86854ca0ad9659fb949161780a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\DEMF6C.exe"C:\Users\Admin\AppData\Local\Temp\DEMF6C.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\DEM64BC.exe"C:\Users\Admin\AppData\Local\Temp\DEM64BC.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\DEMBA0C.exe"C:\Users\Admin\AppData\Local\Temp\DEMBA0C.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\DEMF9A.exe"C:\Users\Admin\AppData\Local\Temp\DEMF9A.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\DEM650A.exe"C:\Users\Admin\AppData\Local\Temp\DEM650A.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\DEMBA5A.exe"C:\Users\Admin\AppData\Local\Temp\DEMBA5A.exe"7⤵
- Executes dropped EXE
PID:2880
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD57ac1c796be88871f188ceb2a4032ca41
SHA1734ff6968914528c97559c2d1055e519b4357045
SHA256b3247520aca1c739384c2f561d73c8fbe77ce4ae8caa750167f4b252dfc538a7
SHA512a79a3859e3a021d4b1fc9bcc2413368ccd5583fefaf48f426bb65490b88cedf9a53d7e50a43bfe08e4ea560da4c97078418381bf2cd2a09f7f3b4040b1e88450
-
Filesize
20KB
MD57b0623ecdf7ef9718323ab65caee7690
SHA124ecac29e37dd07b824a1a76e1595d258c48a1d9
SHA256cc72c8855879d2efbaf8d19bd86fa45dc5fc45be7d514cb9319e4654204244b3
SHA512a54cd58060d201e8afdcb8122a567808faea99ac4c569311699a1079871d7a598dbd062b56049203c9e55872dec1e218456f3747eaf1fa46d4674b25e3be818e
-
Filesize
20KB
MD5c46efcc5be6312e875b27ddf6ac0d5a2
SHA1436b5dd6f740ab4cdfa67b1d85f7e82fa9a5d54b
SHA256f4c3fea9ed01c214c1674c38ced5ca49196f8ad17645f63dc149f108e117b597
SHA51223d249cfaa083e92b4372a7b7ce7094d40cf5e378ba469c14bdac5dcdee17b31e526738a443fb6ca407f0eca614fde9b77923b51a67a3b7a1e417c470797cfb7
-
Filesize
20KB
MD581babbd61216099c6805f3ad26dce1fa
SHA1923fed5efcfbe632a2af7d6661c2144bb65bd8dc
SHA25615df6d01d5a7fcdceafdb10392e73ff985e97a561e9fc1ce19496f3ce408a289
SHA51228b06e48a1b5546118fb485d89fbe020f54e2e81e432be5f3ba6036c18b887b511c65eb2c2d30b5b599ac1212fbec898e9560f60bf4b04dcef21167f236d2c30
-
Filesize
20KB
MD5ed26a4c18494b4733e5b167e2740380b
SHA117aa0ac75d646ededfc4f25857d9eac9eca76cbf
SHA2568361e7ea48ba3535a29b29902e4bda8f28b1e305b732cb1113db93551f27afb0
SHA512000cd4edf662e226820600c7dea7d1442994a5be5d884ab4781ec729ca647a2154d3fab8d9e03ccdf67a2cc63d03b1ca879f05e6d5f994fc1ecf7e10d76e3d5d
-
Filesize
20KB
MD5846211c10a6e7294e2b7bea85a4bdb34
SHA1c5d8215cb004585aba39c504d38573df8dca426e
SHA256a58c41f1c51bbea0b027e17c7fda1ba86578ecbdde917337a83e5048d7163bb5
SHA51226dce07e97d860ac5ad5157542d84b075acd64f7a930878ac910cf50fa38520bb045c437456bdf9e1a611d3cabd2454ac45fbbf6520b0f5e88701f102be821ea