Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 16:45
General
-
Target
f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe
-
Size
162KB
-
MD5
f8609ab67c22d2bf37654b5e5a116603
-
SHA1
80e5e5f922a053f0cde3190eb7b55854b16b8ec8
-
SHA256
ffe91f37e0e95da0df22d9f088028fdb061824134e6667916deb78ba48c3256b
-
SHA512
0537dbb84627d1096e74a940f04789d5274a83a4a2bd5b7b402e4a28408faacd1bd59e49d97200869ee22143b2a9683099222de02490170f4d7723b93489a727
-
SSDEEP
3072:mCWlCXvdH/F008pUttvnog3DJUXvNK+T/b8bITU02MJ2:CCXvRdkotPH3KvNKGD8UU0RJ2
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f8609ab67c22d2bf37654b5e5a116603_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD567e6366bdda2f9ac9cc8ab733de469fe
SHA12c50f314c7d68b30a442a12ddf72c48fe0b0433c
SHA256fd0a35cadf41ae841c67fabac9dcbd9dc756ba252b6443c864f4da9c49e31c4a
SHA51204fe17141b27923a94466caacf7fd74a890b6b4078a0b0be9605f8266ea121b3e6ee04acbc521f1f45b1f715d82a99426b3ed3371f34aaf944a5ef75cff2f4c0
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
108KB