Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe
-
Size
1.9MB
-
MD5
1523980872ad3824c9b9a23b2b5ffcb1
-
SHA1
c88047b473ba15debf5dac04a627029150c9d887
-
SHA256
589d20cbc298aa2e475af7db64239468056bffdddd178eaf4f51762c5bfd49de
-
SHA512
9b76135fa074d13b86725b5832c72f6cab3fa8db78c4ea3d45ee61aa18b29da61acb5da19d10c65f39a0426e50f28b99bd89833d611e06ef53f8e936c8ddbeea
-
SSDEEP
49152:Qoa1taC070delhyAeS0SxEvR3ks34+VO2e7EAm:Qoa1taC07ReS0SxEvR0MCEX
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1748 E62.tmp -
Executes dropped EXE 1 IoCs
pid Process 1748 E62.tmp -
Loads dropped DLL 1 IoCs
pid Process 2208 1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1748 2208 1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe 28 PID 2208 wrote to memory of 1748 2208 1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe 28 PID 2208 wrote to memory of 1748 2208 1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe 28 PID 2208 wrote to memory of 1748 2208 1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1523980872ad3824c9b9a23b2b5ffcb1_JaffaCakes118.exe F178870A4A3310054638CA25DCD6A6CE5B1DF62A47512EB44A146E333AA90F0F595CF043B79B55440123488D1184A48D467E0DDEFA27A0F1D3638EF2883AC9882⤵
- Deletes itself
- Executes dropped EXE
PID:1748
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD539d2281b67c16271208c8785dd364229
SHA13bf655cabf0237604f7033d3fe85d9cb717c5591
SHA256b29ff6ea5e1c2f4428a47dc68c6a2b3c6bf18b766927c834c1ea4f720e7527e7
SHA51294cf12165f359fd2ae7a48383a996c46d8868060b2a2814ad8ab3dac8d822b1d9f2dc20a2a176afccbcd648aa426da587769c015211928a9ca6c16f327361c47