Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 13:59
General
-
Target
f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe
-
Size
82KB
-
MD5
f13a56197946ac0161c27f9172011b71
-
SHA1
985805e540955bca331affec46d900a129e54816
-
SHA256
fc8f8dde953b9788caf58c1e568c60803399a7cb60242c41729347b3077ad47c
-
SHA512
125dfe53aa3721fd61ecd2ecb7f3ceed6ee93c2ceaa2ab16e601ac1d8ed1b4aa2078708687810924febfb2e86fb7d5fb46f1613bf344e3fb3d7a45609960fa65
-
SSDEEP
1536:Nv0nDdTwXC54k58LsfckwJvz1767nQH+DJ8bV1guzmvxcRtiLKU:NMnJTtqsfLwV1767nQm6hlzm5cRwz
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f13a56197946ac0161c27f9172011b71_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD50818fd2e3ea34c3f1411787b91210b72
SHA1db510ab0f6f56cd85f528a88874ecbce64590c0f
SHA25657e3051018468295587355aa68427bfa121469359c555a768634468a6d233c2f
SHA5124a138207b3b531ebc78135756e37a0c3b1a091e9c9247296f566e81ea3e3087170bf588e001a47ae5156c4ffc559d9bc5ca2bcd9529acf4010d88f84f058e671
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB