Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2024, 16:24

General

  • Target

    f3dbf326eb2f17f2266ffbb3a30ef781_JaffaCakes118.exe

  • Size

    92KB

  • MD5

    f3dbf326eb2f17f2266ffbb3a30ef781

  • SHA1

    c75da8024c0b4eb20c3ae27f0b0b72a65a18cead

  • SHA256

    59208d94aa7b9a85cf646d3d77689484d4a505072cb55f8493b2ec060f4d451c

  • SHA512

    a666c962b28790f1cea7ba664c68eabf6b172262c961b0ecc2582f9088735f533618ce9045cb592048f233fcb7365a1f9f0a693c672fe3c409d2c3c0f7af14b5

  • SSDEEP

    1536:bLyweT/wa0fEpvTXDVDYXzNFoW7tuqeL3hpPLe0P+hzK0CmuJd4BXKikc6C:/yweT6fEZ9YiWZLspzeEBbd4M5C

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3dbf326eb2f17f2266ffbb3a30ef781_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f3dbf326eb2f17f2266ffbb3a30ef781_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\f3dbf326eb2f17f2266ffbb3a30ef781_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f3dbf326eb2f17f2266ffbb3a30ef781_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f3dbf326eb2f17f2266ffbb3a30ef781_JaffaCakes118.exe

    Filesize

    92KB

    MD5

    ac199508465b74bd854d90e5aaf10754

    SHA1

    ebff13cbf10b7852758853a4a28c176121df71b2

    SHA256

    bcfa9e9ea38a3b4272374a2be93314df898b2a13a17fe02c4f97f417c310c476

    SHA512

    479d0d2521016434426588f01f08c52ab9bd2db0596da6cfd2e4fd87543198424b6e3ade63f65aaa7f68ec15a1d59cd6327721e2bcba6a0d3fe408e82a737285

  • memory/1172-13-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1172-14-0x00000000000C0000-0x00000000000CE000-memory.dmp

    Filesize

    56KB

  • memory/1172-15-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1172-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1172-22-0x0000000004D70000-0x0000000004D8B000-memory.dmp

    Filesize

    108KB

  • memory/1172-26-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2956-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2956-1-0x00000000000E0000-0x00000000000EE000-memory.dmp

    Filesize

    56KB

  • memory/2956-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2956-12-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB