Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 16:29
Static task
static1
Behavioral task
behavioral1
Sample
f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe
-
Size
385KB
-
MD5
f631c087cb1fb494ddd5f85fcb33e092
-
SHA1
d7ad975719521e610efcf167d3d5a17ac5b9d756
-
SHA256
df766fa95d24b85e49b4658c0bfbf88ebe506b37eaa0a111d35585a5ff46ec8c
-
SHA512
ea77be4436b34dedd1919763fe923e244f916869110d39c33d75f92112f944415a32bb8b79e7b50c941e1a26d0bdd3feeed5f30620815a0da4de49fd1b5fff44
-
SSDEEP
6144:8rrWjPOPGPGY5qkWyBJ35UnR6hrP0rE7A+JNY9dWIbgPufn5xt2LKOB:xvPGoP5UnRy0rE74Pbg2P5xJOB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2800 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2800 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 pastebin.com 4 pastebin.com -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe 2800 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1444 wrote to memory of 2800 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe 28 PID 1444 wrote to memory of 2800 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe 28 PID 1444 wrote to memory of 2800 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe 28 PID 1444 wrote to memory of 2800 1444 f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f631c087cb1fb494ddd5f85fcb33e092_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD563c24cf136d5b0b8b613193929572295
SHA164f9838ca0b6d224fb247383a89b60e997f7a53b
SHA256adda2e66acafe1697b75bb4527d10edf5682c8827a59561a9f8bc1c0f99c9101
SHA51266881e1abe346a0d56e5ec3db4b1c440c6efe49351cf1a357c4013ca4b3eaadc9317988fe2ccbf65810b545e9055d868ddbd78092772ed6dc34ce26027b122ae