Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2024, 04:02

General

  • Target

    f2a4c70584d1e9d7e801c14846f4d978_JaffaCakes118.exe

  • Size

    133KB

  • MD5

    f2a4c70584d1e9d7e801c14846f4d978

  • SHA1

    2ec9853c4a7d3d9461c6c359602d88bf47f80ba4

  • SHA256

    5349136dba2c87bcd49454e5d1cbc9736975d24f405efbfa4e12d7b910651d05

  • SHA512

    00587f195ed2e65a1b76679a40d35de8fe44d0f42be742845331b0d9d294b8eba230ee320caf75b8d6df2e94bd9fdb34f8df13435b74f5c246b8eb7f1d2c8489

  • SSDEEP

    1536:O54sZnZKiSMfTg5U358223Uzhssaknd2Q9S6XweAeixIxVtxFal7n2TcGI9FDEeC:OjTgGu3UzOQN5biOxKl7qeQn4u8cXijQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2a4c70584d1e9d7e801c14846f4d978_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f2a4c70584d1e9d7e801c14846f4d978_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\f2a4c70584d1e9d7e801c14846f4d978_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f2a4c70584d1e9d7e801c14846f4d978_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\f2a4c70584d1e9d7e801c14846f4d978_JaffaCakes118.exe

    Filesize

    133KB

    MD5

    2e1e7b5e4672db9600162a46d36b587c

    SHA1

    a388aea6b6b3af3c878937710d9b073243fee7bf

    SHA256

    be2b0bfe955dcdf90a8d0df01ce257927e2716e1f37dd5eefe172d39b8d2f98b

    SHA512

    cab1e089bd10f64b800d898403d12a82ca5a50c66da2e5bccb4cbd852ae3e2cdfe803a704701a88a5c88e0adbc48bd2dd588352a0482420554696c09cca22ced

  • memory/1664-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1664-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/1664-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1664-14-0x0000000000330000-0x00000000003B6000-memory.dmp

    Filesize

    536KB

  • memory/1664-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2884-17-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2884-18-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2884-43-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB