Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe
-
Size
784KB
-
MD5
10ae62fd8cb4a4f627dd988450efa2af
-
SHA1
2d0d398539e05b88a82d748334047f4a422b8f51
-
SHA256
c1360ed392578d756de9ec3930219a5cfb0172246947b4ed95e35be53c6f70a0
-
SHA512
be992a41b079302bf279fc1e8fb465c2043303dd5bb353d14367c9d4f5937aecf8cbd759987792e509a1eaa6784cd46f317c60d3394d346f8e512ef463bff2be
-
SSDEEP
6144:U8004aNsnQKBBYUzHJ+Qjo1Z0Jl38WkO2UX+848ytgvk5H80xJ1Gsv7V6Zx:U8FCnbLJ+90j36WGSvk5dhS
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4688 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 336 wrote to memory of 2388 336 10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe 83 PID 336 wrote to memory of 2388 336 10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe 83 PID 336 wrote to memory of 2388 336 10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe 83 PID 2388 wrote to memory of 4688 2388 cmd.exe 85 PID 2388 wrote to memory of 4688 2388 cmd.exe 85 PID 2388 wrote to memory of 4688 2388 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\10ae62fd8cb4a4f627dd988450efa2af_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:4688
-
-