Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07/05/2024, 01:59
General
-
Target
1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe
-
Size
2.8MB
-
MD5
1f101af194c4445b253930ad16ac8f60
-
SHA1
f9f49cc0b91e4026c109ed12a118e945490edf24
-
SHA256
1700d693f0aa99d646586d09d0a0079b489198ddc77c078137b4b63189287420
-
SHA512
520722ed560db70d1bb14a9b7e798be7f6ba522bcb37eab8d649731169a9bf4672b4e7bc3d62bb7197d32aefd2db7b7507216aa6c398ec48b700afedf31a00d4
-
SSDEEP
49152:La7j9uH4rwMiyOdm/UPrsolf6HKB2h1Z5azj+Y4t/qvdOvs50oGKWNMvoJT:GtuvMxL0f6qBorazGt/wTOKzvod
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E73C1.tmp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-E73C1.tmp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.tmp" /SL5="$40148,2718172,62976,C:\Users\Admin\AppData\Local\Temp\1f101af194c4445b253930ad16ac8f60_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
696KB
MD54551b18a00f9886738a034da202b528d
SHA1c00a029f89489770ec292c34da1bee969b091112
SHA256481f8369ac57c86a779cf42e589b1d4af041223fe01bb419549a843f2efa07c2
SHA512e8e5d17d12f84f7609b3f3244d873c83dbdd52b6d064df8052dc3e8a3f0394b67dec5de236a047acede2e977787b5e739c2f24463c2db1455625690997d5e35c
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
760KB
-
Filesize
760KB