Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
17/06/2024, 04:31
General
-
Target
b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe
-
Size
563KB
-
MD5
b6c3c2f3671ec8dcb8f5a71d106582cb
-
SHA1
d34b4189f57dd6042e284cb9431d75befae624e8
-
SHA256
1e481ca2092621d936835dc3bf62c955027945effc5c2b2eda846c9735b60845
-
SHA512
61875cc0031932726f17371a7413f9f07aa85d73b79dad5089a6962840788d7ee1ef0cdd80262ee19eb8f610fde07613974d0c1560ab6cb1211f888920464322
-
SSDEEP
12288:hQiGWmbHX0IH0dZNvDBPMACmbHtOXUg8kEhmqVqjxqUqvhd56bna8j:hQieHUZZD9Cm7tOkg8kkmcqjsFEbl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PHAOT.tmp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-PHAOT.tmp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.tmp" /SL5="$400D4,326014,67072,C:\Users\Admin\AppData\Local\Temp\b6c3c2f3671ec8dcb8f5a71d106582cb_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
700KB
MD5f61ce5076b8e33c722dcf5380127fce1
SHA120d50e6db499e53b71a54cd3368cd89e170a02d2
SHA2560d1ae8888ffb53cdc8cfe002849225d10c20fa7cb52c9b756724fc013a99d71f
SHA512a83d755c3b2a374bdbea96487f136377a9abb4be53c1f1eff77a308a4ab21a66158c945ce32ae36ba8e79b468d2dd32c7956cb6ce282c21a2e917796b79df07a
-
Filesize
92KB
-
Filesize
40KB
-
Filesize
92KB
-
Filesize
764KB
-
Filesize
764KB