Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16/04/2024, 02:26
General
-
Target
f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe
-
Size
105KB
-
MD5
f27986621bf6a182f5bcba2b9acfb266
-
SHA1
94c0845c4cae24b3f3228d6951ac5a30e61a1a25
-
SHA256
b30d3db55daccfb14482649a7512c2495352c01b0b6e835136d714e49dc27615
-
SHA512
b27407dc5642336732d0644c47357115ba36c334ee874c9be151d5b5dbcec58c9d1db1e3fe5984ab629bdb1f760b7337e2bcc67c519e148cf747f17ac3dd5e74
-
SSDEEP
1536:jB7OI4GnV6RJ5e9BVzdxMe4ISMbVItEUl1QumquZFGNHd3iTt6DtW9YH:lCI5kynzdxuIHNUl3ub6pW9i
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f27986621bf6a182f5bcba2b9acfb266_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD530d71c1a8607b408451d129a2ec24aec
SHA119ed3d60ef3ae02e5d4e544a87e2085549859a42
SHA25675820d6797f479e6dda510493ca188d4a5fada6cfd006944d1a8cd2dec2f97dd
SHA512fb01875fbe6252b676b74996f70b945cb0bd73e5ae03a9d425bf60b861e7e1dac82e8dd9cb6251474c0ff88015864567d62bdef201af15051c3029b05fdc7eb0
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB