Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
da8eb62581ee73caf1ce481aa1202d08
-
SHA1
a7fa12e3ce22765b4b4d72b0d698bd998a456132
-
SHA256
321832fd912f1d551238f94564c966e2f96062ee6bc503d786ea1dd2f25be42c
-
SHA512
f4ebcffce40b99f8b7f0f0651f9c444f910c7bb19800683750dd695bbc18782c4f66ef004d4608f091492d0c13d80adce7b87d117ed6e2ba77c035244b5d97bf
-
SSDEEP
49152:Qoa1taC070dnWDcadX3DzFvloRxB4aZQkCbtT2wAFZWHg:Qoa1taC0GWAw3VEcbtT2Zj
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4680 43FE.tmp -
Executes dropped EXE 1 IoCs
pid Process 4680 43FE.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4680 1628 da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe 88 PID 1628 wrote to memory of 4680 1628 da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe 88 PID 1628 wrote to memory of 4680 1628 da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe A3728519FE990A4047C3ED7A6E0AE83E85AE0B02F01FB5636A96E155385146A6EFB067337B9A086E8551D9DD2932B745DBB1844A2BC283CBFE9E3989433F3A662⤵
- Deletes itself
- Executes dropped EXE
PID:4680
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5931e0a328802fcccd4faf52d0012e9b6
SHA153fa7f5a589778bfcec45f442df258077f5f51ad
SHA25612580bc962d04ae4b67d50e973ecb8aca63f23ca90135524f462a87701e7e9dd
SHA512e1899d467500bb709677d8779d7222b24f32050c50de525bfe8f2f80e05a85d30999bac60e5318edd98d85a1bca840e4c899e8c738170c3c7277a11c6750d5a5