Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 11:49
Behavioral task
behavioral1
Sample
eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe
-
Size
2.7MB
-
MD5
eaffcb0e67b51a06cf5544d2805b911f
-
SHA1
0ad91a4f25a3aefadad8c94b64ec8a3a81f48d5a
-
SHA256
01adfa786a67d31b4299a380b25f6edfe2963851c4417fa20596de0676c8ab36
-
SHA512
237935ed99f407d373eb1e21c2154103e61e38d61489c0f00c81f5049b2db706cfbbe690bb9234af5bb47f6124d2dd8092f4fd517f297791c76f69ad7cf9b3fa
-
SSDEEP
49152:xnbDWbB1smStTEiipeO0duEGBXMZcSHmsOC83PUf0y:d+bB1sdTEi/d+SqSHmsOc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2540 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2540 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2372-2-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral1/files/0x000a000000012272-16.dat upx behavioral1/memory/2540-18-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe 2540 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2540 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe 28 PID 2372 wrote to memory of 2540 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe 28 PID 2372 wrote to memory of 2540 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe 28 PID 2372 wrote to memory of 2540 2372 eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eaffcb0e67b51a06cf5544d2805b911f_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2540
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD57844a1349cee02c47109aa6608569e4e
SHA1132d4b6e11cdea2c13e62580546e6d7f453fffcc
SHA2566ea1e2ce4546bb176ec53e57169710a2bb5fd7566fc676f730f0d2893a0dd77a
SHA512501648f870e76e5bab8ee6367a4feab10a91b6e086e58bb7d100470790c533b8f849cf60a8202e16788c0ee9b201e9000a28def8a3b35a0b92f5ea40cba1025c