Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
-
Size
932KB
-
MD5
35052f149100475f8307e1d04697ed32
-
SHA1
6aa986abbd9ee14710b34a4e631520d100cef8bb
-
SHA256
2e4c25d5f045a2211f26421511fe5707bc6a754aa3bb3548bf74c8fa2b1b28b4
-
SHA512
54e293a74b90ffabb39cc015a17b55fa22d3e2cd0a898a68739eee6fc9488c8cebf9e05ff26f9dbcb2ba6d1e288c3a1ac09edf1375857f4f09b8a14aa5553bec
-
SSDEEP
12288:1Xmc2JMORj5NPrpGa9a1U53gbFm33WP34Hrk3ajUWm2mDj4nnmsEmS:B5qPPltA1UtF33WA9jUWm2mDjdH
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4152 wrote to memory of 896 4152 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 83 PID 4152 wrote to memory of 896 4152 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 83 PID 4152 wrote to memory of 896 4152 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c .\qelizresa1.bat2⤵PID:896
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239B
MD5d6b1f5f225c4f1df127db0273ce51270
SHA1ab06a820e723537d3e66bb92da194bc8cf17ad20
SHA256f5730a8642942f7fdad29bdd9be7a5f11c43175c82bb3185b1d210ad6c7c4727
SHA512bef9b0edd513fb5e3ebf64163d51e7a71d1caee20f0f566a8d1a204a73004bd4528cb166eb5243168752655d7196b7f7920bed51cbd625eeea626bf3d63c1b25