Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe
-
Size
458KB
-
MD5
14db2dca825fdcdaf5eeb82ae827ccdc
-
SHA1
4390e73a0f664d43c30a389f9285cfe68be4bec1
-
SHA256
155a096b9785b23359d70039e1a0b6c0b56605d2596a52c7e8138531065d6c39
-
SHA512
f8ebbc329ac94b7b181c2f4c620aa54325086c0c95e560355f4d13cfeed1c33f4224d129e975a6830267505b7e9894f6c928b28a5aec7316d08d4ef5740c558a
-
SSDEEP
6144:qJ6VANOasIMiWxBdMt3VcOmHiMGyWbeSXR7e80sYcM4U:qcObyByt3VEgFeoU
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1724 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3260 wrote to memory of 3656 3260 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 95 PID 3260 wrote to memory of 3656 3260 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 95 PID 3260 wrote to memory of 3656 3260 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 95 PID 3656 wrote to memory of 1724 3656 cmd.exe 97 PID 3656 wrote to memory of 1724 3656 cmd.exe 97 PID 3656 wrote to memory of 1724 3656 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:1724
-
-