Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 23:44

General

  • Target

    fb6e8ebbc91eef0abe8b7626315b48a4_JaffaCakes118.exe

  • Size

    133KB

  • MD5

    fb6e8ebbc91eef0abe8b7626315b48a4

  • SHA1

    9595fe32bbeea6f8f090415609054399ef871d30

  • SHA256

    5ba4652d62321f3a9a19e29ff3433a9127a0e649813c89595760d19c5496ef27

  • SHA512

    e2cd2cc531dda65b21d30c1a11c901583247bc53d790efa2a4744a595adfe18a99b922f94c7ba6da1f22632b4b76fd1ee83b32b9ccb95c3da22f2731d9d1492d

  • SSDEEP

    3072:2MyaauA1TCPKzHWVv7ho3yzB/hIdVPBkAWAAedglAnEmN51Q:2b56Tu2B/G3p2A7genPNzQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb6e8ebbc91eef0abe8b7626315b48a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fb6e8ebbc91eef0abe8b7626315b48a4_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Users\Admin\AppData\Local\Temp\fb6e8ebbc91eef0abe8b7626315b48a4_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fb6e8ebbc91eef0abe8b7626315b48a4_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\fb6e8ebbc91eef0abe8b7626315b48a4_JaffaCakes118.exe

    Filesize

    133KB

    MD5

    6a73c1bcd9e551a3541ce7612f4d7683

    SHA1

    ad3894c474860cbc17ab3e502e4907ac18d05242

    SHA256

    f0affc8f3c4d0e5e906afc1d0513f3b12c14fcaa44217eefd44a4f89f28192d5

    SHA512

    660d67a145c198d13128b1682a6b7bcb6dc03c0a5eb8c60a88e8b265491a01ab464482473c64dcd0ea686082629ce242eacd4956368040ea244dee588dd7bbeb

  • memory/3104-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/3104-1-0x00000000001C0000-0x00000000001E1000-memory.dmp

    Filesize

    132KB

  • memory/3104-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3104-14-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4432-15-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4432-17-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4432-16-0x00000000000D0000-0x00000000000F1000-memory.dmp

    Filesize

    132KB

  • memory/4432-31-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB