Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe
-
Size
232KB
-
MD5
e8d4de7c0743adc4d46b86084325ef19
-
SHA1
4cd91a61df25e40141a57302ce6576a66220e03e
-
SHA256
75ffb65008fd09d966362c32a14772d935ce695e5f87b973f6b0d75d4371fb04
-
SHA512
ce14326e87abc4d0837fc29fdddbe0a458b1e25c0d7e7af90851f84294826eb835fc609fe866b1beb8f33740fee761e0ad78bec20d86137d77bf7445dbe01566
-
SSDEEP
3072:ae/z6pTUD6GJG5aPXu8SYe74pm1FmTKMjoJStccKy+VGgkRx+o4M8ndtqh2:awz66iSXDm1FMoJSec4Yg6z8dZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1952 XXWG4AFRXIQJLZ.EXE 2964 XXWG4AFSQ4A.EXE -
Loads dropped DLL 4 IoCs
pid Process 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 1952 XXWG4AFRXIQJLZ.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2964 XXWG4AFSQ4A.EXE 2964 XXWG4AFSQ4A.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1952 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 28 PID 1924 wrote to memory of 1952 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 28 PID 1924 wrote to memory of 1952 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 28 PID 1924 wrote to memory of 1952 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 28 PID 1924 wrote to memory of 2964 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2964 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2964 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 29 PID 1924 wrote to memory of 2964 1924 e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8d4de7c0743adc4d46b86084325ef19_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\XXWG4AFRXIQJLZ.EXE"C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\XXWG4AFRXIQJLZ.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\XXWG4AFSQ4A.EXE"C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\XXWG4AFSQ4A.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10B
MD5859cd8c9815029bfd028febfefa434da
SHA1740ef1a7562b23cb04927a4bd7745697ef81ef8c
SHA2563a4641a64867ee0cfe8be7da484f47132e6cd52d0479bb1b3f488f409e878cbd
SHA512e9a9023db9807d000bb7781b87f1793977020a01543bb7fc4bd3098872217a2be0b53abc2b76c0cd5a0885927302060b37ab46f1f6beb7cff0b99868a11b1ea4
-
Filesize
232KB
MD5e8d4de7c0743adc4d46b86084325ef19
SHA14cd91a61df25e40141a57302ce6576a66220e03e
SHA25675ffb65008fd09d966362c32a14772d935ce695e5f87b973f6b0d75d4371fb04
SHA512ce14326e87abc4d0837fc29fdddbe0a458b1e25c0d7e7af90851f84294826eb835fc609fe866b1beb8f33740fee761e0ad78bec20d86137d77bf7445dbe01566
-
Filesize
28KB
MD5553628c7d0797377d7e881e0cb3a5b1e
SHA1f0b325f8a6c90851de4cc40156ba2bf00bf9d15e
SHA25657b140bac168263cd534ef38b0f7af7ac84bd6a3544dc02a27125c7d1924df6c
SHA5125450874e494b992f6bc4dfdc245c71b820d7864d6a3c7fe972266d3a670f4f564a07bfbb6c74eff2f5999d3c77cc84000895399ca1858e4d74f1069f50a04263