Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 18:27

General

  • Target

    e81ff2d049ddbdb2c76b05120d63da1c_JaffaCakes118.exe

  • Size

    385KB

  • MD5

    e81ff2d049ddbdb2c76b05120d63da1c

  • SHA1

    b2c2d162895befc56022214c99d147817cc505e5

  • SHA256

    a8d8d3cb31c3e2129038ce6d230476a6fb1161ecffa3ae7f718bf50ef3b9618d

  • SHA512

    c0ae03045565621bb4588ebc868538a15eaaf44e50e1c8c548b8a771ee3670e8f6bdafd95c009c9b7771cb631a38a2b20547d85c663f67e323d8ff16927eaccf

  • SSDEEP

    6144:8prUCaryZszfHbIPDpyPEqKRhGaJDeAsHrnFnmABtu9n1/TUggV81WjbPJxhqRum:8pjaryyf7IF4KRh3JbAD6nVw3YWJDGtB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e81ff2d049ddbdb2c76b05120d63da1c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e81ff2d049ddbdb2c76b05120d63da1c_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\e81ff2d049ddbdb2c76b05120d63da1c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e81ff2d049ddbdb2c76b05120d63da1c_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e81ff2d049ddbdb2c76b05120d63da1c_JaffaCakes118.exe

    Filesize

    385KB

    MD5

    8b9a5f65e9cf8c399353b03cc9515b02

    SHA1

    1d98305e03b1f12e644d548223f52060fbe24656

    SHA256

    8a0dd1c6d172b255eae5a12720eb3157e1bcfbbe72873ec06fcbbcbf911c7009

    SHA512

    b8099164f722f2c0334bbee55a102294c5940cb66a198c8913f00f7b9cedaa97d707f8600814919128d76342ff423794a410b389c353a5b069af4cf0430d5e6b

  • memory/488-14-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/488-16-0x0000000001610000-0x0000000001676000-memory.dmp

    Filesize

    408KB

  • memory/488-20-0x0000000004EC0000-0x0000000004F1F000-memory.dmp

    Filesize

    380KB

  • memory/488-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/488-32-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/488-38-0x000000000B820000-0x000000000B85C000-memory.dmp

    Filesize

    240KB

  • memory/488-37-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4556-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/4556-1-0x00000000015A0000-0x0000000001606000-memory.dmp

    Filesize

    408KB

  • memory/4556-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4556-12-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB