Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 04:49
Behavioral task
behavioral1
Sample
32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
32ce5d3fc87e4aca57f85835ebc4421b
-
SHA1
46f23ec79bf4bc8af9c70aac9de2c97f1c86e475
-
SHA256
4e7902ecda9bab41bcb9be24ccfa7cc299ee2e7f26b0ec6ffdeec713969f1920
-
SHA512
a74319d51482b547b6afa249a8079c1bf76fab1bcb9421c3c68cf69f969266f2beefa314dd0880a5001105908e352caf633e4727869454ef14c84b9a6f7049ab
-
SSDEEP
49152:ofD3eCT1OKHTuOto71GJCz81bhMlXtyFF3QjWf2:YDwKyOIkM81OkFFAjWf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2156 winit.exe -
Loads dropped DLL 1 IoCs
pid Process 1700 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1700-0-0x000000013F430000-0x000000013F889000-memory.dmp vmprotect behavioral1/memory/1700-17-0x000000013F430000-0x000000013F889000-memory.dmp vmprotect behavioral1/files/0x00090000000134f5-22.dat vmprotect behavioral1/memory/1700-26-0x000000013F430000-0x000000013F889000-memory.dmp vmprotect behavioral1/memory/2156-44-0x000000013F6A0000-0x000000013FAF9000-memory.dmp vmprotect behavioral1/memory/2156-27-0x000000013F6A0000-0x000000013FAF9000-memory.dmp vmprotect behavioral1/memory/2156-48-0x000000013F6A0000-0x000000013FAF9000-memory.dmp vmprotect -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1700-17-0x000000013F430000-0x000000013F889000-memory.dmp autoit_exe behavioral1/memory/1700-26-0x000000013F430000-0x000000013F889000-memory.dmp autoit_exe behavioral1/memory/2156-44-0x000000013F6A0000-0x000000013FAF9000-memory.dmp autoit_exe behavioral1/memory/2156-27-0x000000013F6A0000-0x000000013FAF9000-memory.dmp autoit_exe behavioral1/memory/2156-48-0x000000013F6A0000-0x000000013FAF9000-memory.dmp autoit_exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1700 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 2156 winit.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2156 1700 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 28 PID 1700 wrote to memory of 2156 1700 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 28 PID 1700 wrote to memory of 2156 1700 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Roaming\WindowsApps\winit.exeC:\Users\Admin\AppData\Roaming\WindowsApps\winit.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD532ce5d3fc87e4aca57f85835ebc4421b
SHA146f23ec79bf4bc8af9c70aac9de2c97f1c86e475
SHA2564e7902ecda9bab41bcb9be24ccfa7cc299ee2e7f26b0ec6ffdeec713969f1920
SHA512a74319d51482b547b6afa249a8079c1bf76fab1bcb9421c3c68cf69f969266f2beefa314dd0880a5001105908e352caf633e4727869454ef14c84b9a6f7049ab