Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/04/2024, 16:05 UTC

General

  • Target

    bca35ee3cf6e630e26b36618796cfda1_JaffaCakes118.exe

  • Size

    3.1MB

  • MD5

    bca35ee3cf6e630e26b36618796cfda1

  • SHA1

    d0411608e57d144efd225498c79b72eb3ad22ad7

  • SHA256

    fd864415a3bcdcce5f670e364ebbd6a00002d5b34a7fd37a201cbfff91c25640

  • SHA512

    f2c2c6323f47f0703482f881dd1f1b198f78b0c82b488dbc08085eb6071f1475e2d0256c75d234823689ba91111cfd83911c35a7e3ab3f0b40c812383235efd4

  • SSDEEP

    49152:0ZSM+nde6v55ictdvTxwmMs2Q5k0eAxomoF68UGc7MlobU3OgGZ1:cade6xSmjoAxx8dc7xbU3c1

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bca35ee3cf6e630e26b36618796cfda1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bca35ee3cf6e630e26b36618796cfda1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\bca35ee3cf6e630e26b36618796cfda1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\bca35ee3cf6e630e26b36618796cfda1_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\bca35ee3cf6e630e26b36618796cfda1_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    f593e9f7687b49812819ae9a7dd10b60

    SHA1

    4c86a25070ede0701826ae5e2149974511609a63

    SHA256

    6fd206db4f08445accbdc4090518acbe2d8fd63fb3eb18836de587287c704019

    SHA512

    27816eb5a63473c627aa0d8f5de9af5e01a5ab93028454ef3ec96cf9e770b7b03fd060f0f19487d6c9b2db98cb450f0298e78befc1bced1ae1e1c77744e2b6a6

  • memory/2212-16-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2212-18-0x00000000002C0000-0x0000000000384000-memory.dmp

    Filesize

    784KB

  • memory/2212-17-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2212-23-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2212-24-0x0000000003150000-0x00000000032E3000-memory.dmp

    Filesize

    1.6MB

  • memory/2212-33-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2512-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2512-2-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/2512-1-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2512-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.