Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 15:56

General

  • Target

    f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe

  • Size

    1003KB

  • MD5

    f62418e6f4cfa6b99e5cc3a8ccd7e5da

  • SHA1

    b1b613925ff5d62ad08ee04f93552e6a1c4b0b3f

  • SHA256

    6119badb7a3a099484ac05687f6ce7a0cb1784ec801269119557dcbeb84b3de3

  • SHA512

    65730f5670cd53b56135f686aee55d06714bf66214277f9aa11df2c03919b2938b950e473b601b36b4fcae7e00ef6eae9ce11942c7b6b19db0cc554fe9aa35f6

  • SSDEEP

    24576:qKeyxTAJj7P+yWw1S5osrRH8rxQM2uTSRjOT2rsrWgd9zLoMdB:qKeyRA0yz14rRH8X29cT24rWsAMH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Program Files (x86)\owhyyild\uorgurfor.exe
      "C:\Program Files (x86)\owhyyild\uorgurfor.exe"
      2⤵
      • Executes dropped EXE
      PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\owhyyild\uorgurfor.exe

    Filesize

    1012KB

    MD5

    39c8d29735d62c4285d5e10ac5eaee61

    SHA1

    a563fedab4f83c0f891f10c9782bd484ab3294fa

    SHA256

    39c92b91665e9ea941e33f3a97b773945fd56f0d53b0c95e79be90e4c6e35b33

    SHA512

    fc53fc382cb2e0a729324b521afc6f35663a0c3a628b7dbe77ea94c7d21d0acd3849801a6a1751c7d5497ebe9045c287b3da138065108a69b3fe6c819175a1a4

  • memory/2300-8-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2300-7-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2300-9-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/4516-0-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/4516-1-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/4516-5-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB