Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 08:07

General

  • Target

    2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

  • Size

    133KB

  • MD5

    2f9460313f9c3161360261123cbdf504

  • SHA1

    a0d5f5149231a6f1b0a677c8079c491a54756797

  • SHA256

    f725eba756edaa8f7410b10a15e05141e2613b5d38fa4172b092261d66dbc554

  • SHA512

    d70320743655002d1688102e6b449949f38f9d10288f5211d965710fa87cde6d66ae5f3175c2fb592e20c67140dde160d1f2b947535cb65416e23b2ecfc5fad9

  • SSDEEP

    3072:hi0/YIlzQruqbCLxvPgUgVl2L6DFpM9tAuFR3GkOIusQyInBs6cQ:PllzQyqA8Vl3fkEYEK6cQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2f9460313f9c3161360261123cbdf504_JaffaCakes118.exe

    Filesize

    133KB

    MD5

    0c1222304ee39d720d802c6297e52b89

    SHA1

    28f727ed1c3641a41464125923adc6cb9fb2759b

    SHA256

    5fb88e7469ea4057720c362b68019ba12936caeac351cc9141d9e28dce4f199e

    SHA512

    68f6c6563e12de6be69827c2eb2ac2ec6c3b87fd0bceac5db97db553a5752df2d5fe73ca47fb9ce0044d0ddfec1a86195bfc750d774c015cea6230305483c64a

  • memory/1252-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1252-1-0x0000000001560000-0x0000000001581000-memory.dmp

    Filesize

    132KB

  • memory/1252-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1252-14-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4788-15-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4788-16-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4788-22-0x00000000001C0000-0x00000000001E1000-memory.dmp

    Filesize

    132KB

  • memory/4788-30-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB