Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/04/2024, 12:29

General

  • Target

    ff47122ad3bf442218a2a197f82a7e01_JaffaCakes118.exe

  • Size

    82KB

  • MD5

    ff47122ad3bf442218a2a197f82a7e01

  • SHA1

    a7963aab46cd5d9af633f51f917761f281911043

  • SHA256

    c4b8bd7e537fdf0481a7b039c8c124924d9da65c5c22b6617bcfb8c97a1d567d

  • SHA512

    ffe831b612d02ed152ff1d699abd64e883bd8b85119c3773d70072f521bca43923bceffc84c1b23be6f6a23c0a3a5b358c2994868ea013dc60ec9fe93d6ddf56

  • SSDEEP

    1536:U83elnNrVDcX4S8UMbCvQzdj0OULoir0hduWLbTszyw9Gqv3Y1MonKa+JjIUglaL:z2ptbCv0YvLoirSd/InyuUKBJNT

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff47122ad3bf442218a2a197f82a7e01_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff47122ad3bf442218a2a197f82a7e01_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Local\Temp\ff47122ad3bf442218a2a197f82a7e01_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ff47122ad3bf442218a2a197f82a7e01_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ff47122ad3bf442218a2a197f82a7e01_JaffaCakes118.exe

    Filesize

    82KB

    MD5

    3b8413225e9015fc57dfb4ddd20dbf91

    SHA1

    c58fdacf581d60d3dad27d12de3d449491839e6c

    SHA256

    8f919294de68385a3f14dfb7c9fb8c570a2a4e44ac6624d8fcbb0ca0604057ee

    SHA512

    7e6aaa803a31332aefb992d9594b0290d6d021cc4d23a0b6e15a0b6fb53dca19c7062a615b208dfaa14a1e384ee84f9b740bbe3594bf4ffd88bf46a600d45422

  • memory/1184-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1184-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1184-1-0x0000000000140000-0x000000000016F000-memory.dmp

    Filesize

    188KB

  • memory/1184-12-0x0000000000190000-0x00000000001BF000-memory.dmp

    Filesize

    188KB

  • memory/1184-15-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2232-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2232-18-0x00000000001C0000-0x00000000001EF000-memory.dmp

    Filesize

    188KB

  • memory/2232-24-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2232-28-0x0000000000220000-0x000000000023B000-memory.dmp

    Filesize

    108KB