Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 10:23
Behavioral task
behavioral1
Sample
f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe
-
Size
784KB
-
MD5
f58dbdbf39f28d4b430c2a70a3e908c1
-
SHA1
4e580aba388116064d2f5fbb0cbb9164b5ea8e41
-
SHA256
8a69ed50dbe22d168c600048d6b03d8989d9481814e30f720e77d7b55297c3a2
-
SHA512
7059a4cf63274088193e03558ccecd36d3610c8ef26357ae4568b3841490eb26c4fa20fbd099fb8762e45fa36d59edd3690b5503debfc0da5f63c6d81e62be5f
-
SSDEEP
12288:mfdjCj6+hyLmFUJ8JvWk+L4XJsrd8ND+I9+8rNNKYt1UqUYg+wVzMqSYyK:mNChyLH8s3L4ZsU+8rNNKw1lHgPdMqN
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/1344-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1344-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1392-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1392-21-0x00000000054C0000-0x0000000005653000-memory.dmp xmrig behavioral2/memory/1392-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1392-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1392 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1392 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1344-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000a00000002337f-11.dat upx behavioral2/memory/1392-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1344 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1344 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe 1392 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1344 wrote to memory of 1392 1344 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe 90 PID 1344 wrote to memory of 1392 1344 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe 90 PID 1344 wrote to memory of 1392 1344 f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1392
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5a452da3a120e5a44d8865402654f9f2c
SHA1661328aea8fc8a99fae92244fd39ba086e0d272d
SHA256322513d5a96707363adefe0bc12d2435d47f3ba7d2c44cd74e0466df3533f57c
SHA5128fb87122fac0ec07c7cd0d6c51d5afd8044f635ec06468f08f5b92f94a4a1479b7230c625cb31ecb165128c138e6297a823a14e28637507fc2e70e07f5348503