Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
16f48814678483bc9a25b8e1f85e8afd
-
SHA1
1ce2436ea469b915d3de03692644e50febd4671a
-
SHA256
ca46a1b0778c2f3a06c1ec8b6870c1983e9caa9a52ed3e5a4faa3f38f1ea05df
-
SHA512
8061f352b953349bc037d534b9901bda13b54eb238bc3c311fe52185fad536a7d8720a6b68276a8aa9b9258464ffcf72547c49821398560685498e993493c174
-
SSDEEP
24576:stH/MYB2AfNKfbedtalkMdCMHzQMPIwYJLRqthKFz6FE4aS1WjR4v:mMmkDo/cCW9L6LRqthSqv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1440 explorep.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\explorep.exe 16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe 1440 explorep.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3620 16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe 3620 16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe 1440 explorep.exe 1440 explorep.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3620 wrote to memory of 1440 3620 16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe 88 PID 3620 wrote to memory of 1440 3620 16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe 88 PID 3620 wrote to memory of 1440 3620 16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\16f48814678483bc9a25b8e1f85e8afd_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\WINDOWS\explorep.exeC:\WINDOWS\explorep.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:81⤵PID:1040
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD5cccce53070587ca7529c7faaa3c668aa
SHA101329eabb79ddad8204ffacd3bcd569f055c733f
SHA25656a962ab0d435f1ebf057959ff89e9e72456315f7427ef072ce3c8ad181161ae
SHA512405b2131cc421700a6feca2319d53622fe131711d9973da29feafb8da956ef3d4e613f70aa240f6277d1c43abc2de53e5e492e691f7ffbe9bd83d67d90248410