Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 20:29
Behavioral task
behavioral1
Sample
f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f1dc579aab26e21eceadec0a392709ec
-
SHA1
59661cccf1c2d8ef5aadcd81e7f316319ee4cd4b
-
SHA256
0639974033c94031b6fdc04b1d44a3b37af0b8d03fe98e3fb13f1fb6100d9871
-
SHA512
d10e4a1052b1c813702592e80efedfcd3100952091394c022e81974594e1bfd4f93a9270590822e5399ca7c592abc1e4bfa0ab67990e85b4216003362f470810
-
SSDEEP
24576:Ex3a3t014+bIiavmtbzncQxFSWjww7BRJz5qBbvDIMc0nix5gk+GsrbeTagxvG:ER1wiav+znc+FSWjwqBRd5qBbY0q+1H
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2248 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2248 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral1/files/0x000c000000012240-13.dat upx behavioral1/memory/2248-15-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe 2248 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2248 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2248 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2248 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2248 2168 f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f1dc579aab26e21eceadec0a392709ec_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2248
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD54df62e05aeaaebda7a5ab421165d2080
SHA1da207647510d7ad430eb726f97e4f83e3696581a
SHA2565aca98ce5169448c75a079df2d843764782e528f67d0d94f70f14e584aa70850
SHA512c3f251bc8beaff49a3d563c3f183af7a619a2993ac0003d83a51a374272a87b44d6f444b5392271e622f42707b02a463b9ed8a37787eb31c9c157c26128ce0ea