Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 16:45

General

  • Target

    f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe

  • Size

    162KB

  • MD5

    f8609ab67c22d2bf37654b5e5a116603

  • SHA1

    80e5e5f922a053f0cde3190eb7b55854b16b8ec8

  • SHA256

    ffe91f37e0e95da0df22d9f088028fdb061824134e6667916deb78ba48c3256b

  • SHA512

    0537dbb84627d1096e74a940f04789d5274a83a4a2bd5b7b402e4a28408faacd1bd59e49d97200869ee22143b2a9683099222de02490170f4d7723b93489a727

  • SSDEEP

    3072:mCWlCXvdH/F008pUttvnog3DJUXvNK+T/b8bITU02MJ2:CCXvRdkotPH3KvNKGD8UU0RJ2

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe

    Filesize

    162KB

    MD5

    67e6366bdda2f9ac9cc8ab733de469fe

    SHA1

    2c50f314c7d68b30a442a12ddf72c48fe0b0433c

    SHA256

    fd0a35cadf41ae841c67fabac9dcbd9dc756ba252b6443c864f4da9c49e31c4a

    SHA512

    04fe17141b27923a94466caacf7fd74a890b6b4078a0b0be9605f8266ea121b3e6ee04acbc521f1f45b1f715d82a99426b3ed3371f34aaf944a5ef75cff2f4c0

  • memory/3968-0-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3968-1-0x0000000001430000-0x000000000145E000-memory.dmp

    Filesize

    184KB

  • memory/3968-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3968-11-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4384-13-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/4384-16-0x00000000001B0000-0x00000000001DE000-memory.dmp

    Filesize

    184KB

  • memory/4384-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4384-23-0x00000000014E0000-0x00000000014FB000-memory.dmp

    Filesize

    108KB