Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 14:00

General

  • Target

    ff704ba59ba24823797093bfc369ab22_JaffaCakes118.exe

  • Size

    5.1MB

  • MD5

    ff704ba59ba24823797093bfc369ab22

  • SHA1

    2fa4e63c26f5231a50b6a073a733a388a508322f

  • SHA256

    9aebcaca444a03f98ddd2c1ed2402a4ae976101d86b7dce9244afc4f15ae1f23

  • SHA512

    dab0b2a7612c01534bc73846b1d19ad366262ce11b9f62cd55aad0cd49c80c670e83a986a0d4a9b532756855758fff22feda661d06c25df0a9ceb0a4b0a627c8

  • SSDEEP

    49152:kAsgwvJv52M7l4jz9naGDt7bcJhyeay3f9UkozqOBp/NdDDgDy4F2Ix8zMN/LG+5:65554H93Viy23mYorZfq2P4t3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff704ba59ba24823797093bfc369ab22_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff704ba59ba24823797093bfc369ab22_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Users\Admin\AppData\Local\Temp\ff704ba59ba24823797093bfc369ab22_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ff704ba59ba24823797093bfc369ab22_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ff704ba59ba24823797093bfc369ab22_JaffaCakes118.exe

    Filesize

    5.1MB

    MD5

    f020fcee31e4c73a8723a7782ca3374f

    SHA1

    6d6e2ac43858277417c2f17780dcab1a9f95e2ad

    SHA256

    65467108e8636a3232987d92b9f63aa0c5408a9954973aa80626fb9ac2ae5a41

    SHA512

    8a8d3d9db49402f0bf1cfda561ff24ae39fac0483c8764131436fe1bc7e1ba1b4ce2c8cc6d30712b21d1e822f0b7d06e79c5970e42a966873a07b7d483886477

  • memory/2452-15-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2452-18-0x0000000002190000-0x00000000023EA000-memory.dmp

    Filesize

    2.4MB

  • memory/2452-40-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4484-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4484-1-0x0000000002070000-0x00000000022CA000-memory.dmp

    Filesize

    2.4MB

  • memory/4484-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/4484-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB