Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe
-
Size
96KB
-
MD5
1bc7c2dc43779cca98fe800f1e5de95e
-
SHA1
c9f62dd1ef13e0f8e88a882ae97c0737a962770a
-
SHA256
a88e9f71888bde4e1544afb2f4d38a238b1423c4c5e0b21e99153d7a91de4a45
-
SHA512
7394a1c5fe8f56f695e634d99c5e4c339d15af4a48e4fb35bb9f6539f3ce298dd3a63f74cfeba9fbdc23095fec3f02e0c221a5c4fb354e05e0b42c268f11e305
-
SSDEEP
768:LYAdknRMDcDmRG6uB3T7uGJK/sYAdknZOfdlGcQ6mOyFDd+jC7mVBe7/:Eh6oP6KD7uJhZOXQyydd+27MBq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2468 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\gdqqhxi32.cfg 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gdqqhxi32.dll 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe File created C:\Windows\SysWOW64\gdqqhxi32.dll 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2468 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe 2468 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 37 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2468 wrote to memory of 3560 2468 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe 91 PID 2468 wrote to memory of 3560 2468 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe 91 PID 2468 wrote to memory of 3560 2468 1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\1bc7c2dc43779cca98fe800f1e5de95e_JaffaCakes118.exe"2⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:5012
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD599f0ef41b2a4c61f9d0ef8775864a685
SHA17067b16ff21b957b645a030f466c38e3af568a7e
SHA256cb83cd82e60d8adf0d740d7bc9735a71581ce0a0bcda2d2fd159ce9e52590bf2
SHA512b2ca322d83bc27acb8b00f2a84f228c6a9b52a9f672560519eb849ce19b765ac12762314af9c750a1487a0e8a4652693b3842bbab4e9e06740967f6ba052e9c4
-
Filesize
12KB
MD51a2de1b80c6391612ee10b7a9941258c
SHA12bc252895427cee52921ad8399bf8471c5bdeba1
SHA256c368c5534e32f74f281462de4a8d73bdaef62293f77bb85ae4d0f85a60cf8c40
SHA512d64f4bb99c326e0f6edfdc367b21e4976ab3ad17d046eeebab50f20f6c4245f565779169b945efadf6a12d077fddb5662ae097334d17367aa060b691c4e76ea4
-
Filesize
58B
MD55602febf87bd4c535da2d4e90f56e52b
SHA1e563ac3a277e614480525dc60061a06afe1a0419
SHA256569f5ce34e8e491d1b425b57cc90c1463d72eb531983727557802b17c148486b
SHA512b0e8186706e004b800f3e554171c2a3d8c7391b5d0ba8694380fdfdd12fb09330033a1af29bdc8898a09fabad611aaa98e3deb51d2e4d6e1e0d524b673eddb0f