Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe
-
Size
574KB
-
MD5
33b6e51959b2d44de5128008344239f9
-
SHA1
4a5a00505341b63da42becbe1aed5790dfa7bd4a
-
SHA256
7f2818baa96765f62fc166820a3dd5b3edfd964a93a9a3eeb575ca1c5cce339d
-
SHA512
e63748f4eb3e0aa7e7fc76f98dc0b82f821f7cc6bc1a0cc710ff10a2896a860d1962b6840a0a05e694a1aaf9722fc9b83c18c5c12a1d44cce8156edad2b1e3fd
-
SSDEEP
12288:CQiGMLt82B+lsiKjthF3YYVj+MBTlPadSfXioRcpMXVJoT:CQidLt7AJKnBYBMBTlP0QjcpMXVJoT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2504 33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp -
Loads dropped DLL 3 IoCs
pid Process 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 2504 33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp 2504 33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2504 33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28 PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28 PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28 PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28 PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28 PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28 PID 1936 wrote to memory of 2504 1936 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\is-L5CB1.tmp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-L5CB1.tmp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp" /SL5="$5014E,330426,56832,C:\Users\Admin\AppData\Local\Temp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2504
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
691KB
MD59303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f