Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 17:47

General

  • Target

    da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe

  • Size

    1.9MB

  • MD5

    da8eb62581ee73caf1ce481aa1202d08

  • SHA1

    a7fa12e3ce22765b4b4d72b0d698bd998a456132

  • SHA256

    321832fd912f1d551238f94564c966e2f96062ee6bc503d786ea1dd2f25be42c

  • SHA512

    f4ebcffce40b99f8b7f0f0651f9c444f910c7bb19800683750dd695bbc18782c4f66ef004d4608f091492d0c13d80adce7b87d117ed6e2ba77c035244b5d97bf

  • SSDEEP

    49152:Qoa1taC070dnWDcadX3DzFvloRxB4aZQkCbtT2wAFZWHg:Qoa1taC0GWAw3VEcbtT2Zj

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\43FE.tmp
      "C:\Users\Admin\AppData\Local\Temp\43FE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\da8eb62581ee73caf1ce481aa1202d08_JaffaCakes118.exe A3728519FE990A4047C3ED7A6E0AE83E85AE0B02F01FB5636A96E155385146A6EFB067337B9A086E8551D9DD2932B745DBB1844A2BC283CBFE9E3989433F3A66
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\43FE.tmp

    Filesize

    1.9MB

    MD5

    931e0a328802fcccd4faf52d0012e9b6

    SHA1

    53fa7f5a589778bfcec45f442df258077f5f51ad

    SHA256

    12580bc962d04ae4b67d50e973ecb8aca63f23ca90135524f462a87701e7e9dd

    SHA512

    e1899d467500bb709677d8779d7222b24f32050c50de525bfe8f2f80e05a85d30999bac60e5318edd98d85a1bca840e4c899e8c738170c3c7277a11c6750d5a5

  • memory/1628-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

  • memory/4680-5-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB