Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 04:49
Behavioral task
behavioral1
Sample
32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
32ce5d3fc87e4aca57f85835ebc4421b
-
SHA1
46f23ec79bf4bc8af9c70aac9de2c97f1c86e475
-
SHA256
4e7902ecda9bab41bcb9be24ccfa7cc299ee2e7f26b0ec6ffdeec713969f1920
-
SHA512
a74319d51482b547b6afa249a8079c1bf76fab1bcb9421c3c68cf69f969266f2beefa314dd0880a5001105908e352caf633e4727869454ef14c84b9a6f7049ab
-
SSDEEP
49152:ofD3eCT1OKHTuOto71GJCz81bhMlXtyFF3QjWf2:YDwKyOIkM81OkFFAjWf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1176 winit.exe -
resource yara_rule behavioral2/memory/4592-0-0x00007FF761040000-0x00007FF761499000-memory.dmp vmprotect behavioral2/memory/4592-1-0x00007FF761040000-0x00007FF761499000-memory.dmp vmprotect behavioral2/files/0x0007000000023409-7.dat vmprotect behavioral2/memory/4592-8-0x00007FF761040000-0x00007FF761499000-memory.dmp vmprotect behavioral2/memory/1176-10-0x00007FF681220000-0x00007FF681679000-memory.dmp vmprotect behavioral2/memory/1176-11-0x00007FF681220000-0x00007FF681679000-memory.dmp vmprotect behavioral2/memory/1176-15-0x00007FF681220000-0x00007FF681679000-memory.dmp vmprotect -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4592-1-0x00007FF761040000-0x00007FF761499000-memory.dmp autoit_exe behavioral2/memory/4592-8-0x00007FF761040000-0x00007FF761499000-memory.dmp autoit_exe behavioral2/memory/1176-11-0x00007FF681220000-0x00007FF681679000-memory.dmp autoit_exe behavioral2/memory/1176-15-0x00007FF681220000-0x00007FF681679000-memory.dmp autoit_exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4592 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 4592 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 1176 winit.exe 1176 winit.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4592 wrote to memory of 1176 4592 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 83 PID 4592 wrote to memory of 1176 4592 32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\32ce5d3fc87e4aca57f85835ebc4421b_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Roaming\WindowsApps\winit.exeC:\Users\Admin\AppData\Roaming\WindowsApps\winit.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD532ce5d3fc87e4aca57f85835ebc4421b
SHA146f23ec79bf4bc8af9c70aac9de2c97f1c86e475
SHA2564e7902ecda9bab41bcb9be24ccfa7cc299ee2e7f26b0ec6ffdeec713969f1920
SHA512a74319d51482b547b6afa249a8079c1bf76fab1bcb9421c3c68cf69f969266f2beefa314dd0880a5001105908e352caf633e4727869454ef14c84b9a6f7049ab