Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/04/2024, 16:45
General
-
Target
f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe
-
Size
162KB
-
MD5
f8609ab67c22d2bf37654b5e5a116603
-
SHA1
80e5e5f922a053f0cde3190eb7b55854b16b8ec8
-
SHA256
ffe91f37e0e95da0df22d9f088028fdb061824134e6667916deb78ba48c3256b
-
SHA512
0537dbb84627d1096e74a940f04789d5274a83a4a2bd5b7b402e4a28408faacd1bd59e49d97200869ee22143b2a9683099222de02490170f4d7723b93489a727
-
SSDEEP
3072:mCWlCXvdH/F008pUttvnog3DJUXvNK+T/b8bITU02MJ2:CCXvRdkotPH3KvNKGD8UU0RJ2
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5fb523a734e4770904f26436db13368c7
SHA192a01b20715485790e49de5e294897c416fe071d
SHA256ab9ee728e9bdc68e7af4bd07bf334d1a4e086a1bdc6cc569a7898821e03e7578
SHA51254de4a499fbbab3e37558284e1ba242157ab5bacf8e854cbcbf875e9abbfeb1c26365d8d62259899828f7143a429bb54316b397f124ca5eb7ba4284ddd0ca3f6
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
184KB
-
Filesize
108KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
108KB