Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe
-
Size
1003KB
-
MD5
f62418e6f4cfa6b99e5cc3a8ccd7e5da
-
SHA1
b1b613925ff5d62ad08ee04f93552e6a1c4b0b3f
-
SHA256
6119badb7a3a099484ac05687f6ce7a0cb1784ec801269119557dcbeb84b3de3
-
SHA512
65730f5670cd53b56135f686aee55d06714bf66214277f9aa11df2c03919b2938b950e473b601b36b4fcae7e00ef6eae9ce11942c7b6b19db0cc554fe9aa35f6
-
SSDEEP
24576:qKeyxTAJj7P+yWw1S5osrRH8rxQM2uTSRjOT2rsrWgd9zLoMdB:qKeyRA0yz14rRH8X29cT24rWsAMH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2300 uorgurfor.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\owhyyild\uorgurfor.exe f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4516 wrote to memory of 2300 4516 f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe 87 PID 4516 wrote to memory of 2300 4516 f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe 87 PID 4516 wrote to memory of 2300 4516 f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f62418e6f4cfa6b99e5cc3a8ccd7e5da_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files (x86)\owhyyild\uorgurfor.exe"C:\Program Files (x86)\owhyyild\uorgurfor.exe"2⤵
- Executes dropped EXE
PID:2300
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD539c8d29735d62c4285d5e10ac5eaee61
SHA1a563fedab4f83c0f891f10c9782bd484ab3294fa
SHA25639c92b91665e9ea941e33f3a97b773945fd56f0d53b0c95e79be90e4c6e35b33
SHA512fc53fc382cb2e0a729324b521afc6f35663a0c3a628b7dbe77ea94c7d21d0acd3849801a6a1751c7d5497ebe9045c287b3da138065108a69b3fe6c819175a1a4