Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe
-
Size
300KB
-
MD5
2bb4c657c34f640c087cf2018f48184d
-
SHA1
b4d98b6d2fc5682711f458bdfe8c7af838c60f41
-
SHA256
b8bf8b9e823702e4028c3dc2bd6f1cac5b47bbed044479e6731972ca0db9f4a3
-
SHA512
25579ee06d7a1bc8dbf1e53f46494b0958ff3afa010920bcc45c56c6cc03f39f7dfe43b8c21de50033caad8258d6da86282e69bf6f8a840b8de727943b1f30a9
-
SSDEEP
6144:jp1eHtHuPdq1i/qwdm+4ddvSLKv/xesM3QVfway9c3sKGeygTp2yFQ:tANHuPQ1AB2DhesM3ufwjO3ODgjFQ
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4604 set thread context of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84 PID 4604 wrote to memory of 4944 4604 2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2bb4c657c34f640c087cf2018f48184d_JaffaCakes118.exe"2⤵PID:4944
-