Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe
-
Size
318KB
-
MD5
442c8b98c35312abece350ff2fc89d67
-
SHA1
3670365fde42e45a751fcc0802397081ab49a19e
-
SHA256
060335861774dd5b8c9b0f97426c9a234bd02787ee6ae13e90668e56afa76e05
-
SHA512
6078cafa19003a93e0c6bf034805861782ae3fbac7331a0f7e59d7cb49d5ee29820c97c97809e8915b7f1b47c76c6786c50438c940ad77129e1b67f2181be72b
-
SSDEEP
6144:gFkLQrMQ5iz/DKzpaLsi3xZWeKP8EytCgJn5gotBpAuS8BqQjGuJF:QkLQrMQ5iPSaLvTW8sa+oZABcfJF
Malware Config
Signatures
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3780 PING.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1432 2332 442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe 96 PID 2332 wrote to memory of 1432 2332 442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe 96 PID 2332 wrote to memory of 1432 2332 442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe 96 PID 1432 wrote to memory of 3780 1432 cmd.exe 98 PID 1432 wrote to memory of 3780 1432 cmd.exe 98 PID 1432 wrote to memory of 3780 1432 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\442c8b98c35312abece350ff2fc89d67_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:3780
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:2348