Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe
-
Size
99KB
-
MD5
2910986d9767fbbd405170ff6aa660b1
-
SHA1
78f53c86f5a53885ce8a189ec45fbd04a686593a
-
SHA256
8ceb0b36e3c8622861e5a652441249e34a03f1e532d1913f0c92634564212812
-
SHA512
9ed778fad363aad467257c9441df91ea6572e93f889ae797e0ff62e79ebba3da06c8dd93fbfff82cc5da8d80ffe9e00057d389fd16ee7f98cd9346fb271f4692
-
SSDEEP
1536:OOdFyasQh6BBq/AE6W+wskjOk8pzH9euzlUidKR4drzyk5CogZznkhfIO9Fea:9GdQhnAE6fwqzdeuzlUiBikAN5khdB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3528 tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3000 set thread context of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3528 tmp.exe 3528 tmp.exe 3528 tmp.exe 3528 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3708 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3000 wrote to memory of 3708 3000 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 83 PID 3708 wrote to memory of 3528 3708 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 85 PID 3708 wrote to memory of 3528 3708 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 85 PID 3708 wrote to memory of 3528 3708 2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe 85 PID 3528 wrote to memory of 3592 3528 tmp.exe 56 PID 3528 wrote to memory of 3592 3528 tmp.exe 56 PID 3528 wrote to memory of 3592 3528 tmp.exe 56 PID 3528 wrote to memory of 3592 3528 tmp.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\2910986d9767fbbd405170ff6aa660b1_JaffaCakes118.exe3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5deef4643e637eebfa8e77e5addd1fdef
SHA132baadb9ec5855cebbeb5f19df14457728c2a149
SHA256c7f098bb6dc397b89ce9e548f96561397dc661a9d2727af62be06733cdec23c8
SHA51204cafb5e42fd4a67dd1a64881196aeb345a5a76bc9ba6de03776f0a477896cd6d34c2458d7ba06e59c2b23c7da8ceeeaf9d425cc6fcf2b0ac6530dbe7f5f11d9