Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe
-
Size
574KB
-
MD5
33b6e51959b2d44de5128008344239f9
-
SHA1
4a5a00505341b63da42becbe1aed5790dfa7bd4a
-
SHA256
7f2818baa96765f62fc166820a3dd5b3edfd964a93a9a3eeb575ca1c5cce339d
-
SHA512
e63748f4eb3e0aa7e7fc76f98dc0b82f821f7cc6bc1a0cc710ff10a2896a860d1962b6840a0a05e694a1aaf9722fc9b83c18c5c12a1d44cce8156edad2b1e3fd
-
SSDEEP
12288:CQiGMLt82B+lsiKjthF3YYVj+MBTlPadSfXioRcpMXVJoT:CQidLt7AJKnBYBMBTlP0QjcpMXVJoT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2432 33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 976 wrote to memory of 2432 976 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 82 PID 976 wrote to memory of 2432 976 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 82 PID 976 wrote to memory of 2432 976 33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\is-GOFJO.tmp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-GOFJO.tmp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.tmp" /SL5="$80090,330426,56832,C:\Users\Admin\AppData\Local\Temp\33b6e51959b2d44de5128008344239f9_JaffaCakes118.exe"2⤵
- Executes dropped EXE
PID:2432
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
691KB
MD59303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f