Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe
-
Size
237KB
-
MD5
0ee37ea44c1573723346c13586fcac4c
-
SHA1
030bd42c35207837a372cd1f0c13060c5f6a96e3
-
SHA256
e9114d3a81bb51030cfdd32d36521cf2bf1d698b903412cc72e65788b71ecfee
-
SHA512
6bfa1a42fa2ec0c76b4efc0fa3086d89007f92576c12e719e55089f6c8c7c602da15355bade47f35b4f073b68d08c814075d9e508018dcbaaa70b3833636ae66
-
SSDEEP
6144:GmnWnJoOryJibLf69Vcc4gUA2vJCM/aBpURhmVWf0A6Fuwb:5W+GrbE94gH2vJCYRhDf0AA3b
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YmuptsE = "c:\\ProgramData\\JkqkcsL\\FcawicE\\YmuptsE.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3280 set thread context of 756 3280 0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe 92 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3280 wrote to memory of 756 3280 0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe 92 PID 3280 wrote to memory of 756 3280 0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe 92 PID 3280 wrote to memory of 756 3280 0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe 92 PID 3280 wrote to memory of 756 3280 0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe 92 PID 3280 wrote to memory of 756 3280 0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0ee37ea44c1573723346c13586fcac4c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe2⤵
- Adds Run key to start application
PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11049150160560877369,2866371920339304689,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:81⤵PID:640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237KB
MD50ee37ea44c1573723346c13586fcac4c
SHA1030bd42c35207837a372cd1f0c13060c5f6a96e3
SHA256e9114d3a81bb51030cfdd32d36521cf2bf1d698b903412cc72e65788b71ecfee
SHA5126bfa1a42fa2ec0c76b4efc0fa3086d89007f92576c12e719e55089f6c8c7c602da15355bade47f35b4f073b68d08c814075d9e508018dcbaaa70b3833636ae66