Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe
-
Size
212KB
-
MD5
3b0ac82e98518d0e7e8f2188d3077987
-
SHA1
77dbb003ab39fff4000d9ade701cc338d6b64e3b
-
SHA256
122adb7aca34095fba6a288e07b1ce12192a99c626a2428c8e460eb517a6903a
-
SHA512
dc7ed8b8e2383a6892bdd8461c6031dd82cc9cadcc44baf9795c2481829c0768a097c162ed00a60477d0e927db8caffc6a6da00189a226d2c159e0398421f336
-
SSDEEP
3072:XV2syVGcegYpDZ6Unfis4YVYWtBH8TCcE2hlbeMgg6BhraivprqU07UHF:UVggYpDZtfCPWtRu5hlbqlAivpmU0KF
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
pid Process 4256 taskmngr.exe 3572 taskmngr.exe 3824 taskmngr.exe 544 taskmngr.exe 4852 taskmngr.exe 2700 taskmngr.exe 2336 taskmngr.exe 1844 taskmngr.exe 4372 taskmngr.exe 4984 taskmngr.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe 3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe 3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File created C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe File opened for modification C:\Windows\SysWOW64\taskmngr.exe taskmngr.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4452 wrote to memory of 4256 4452 3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe 85 PID 4452 wrote to memory of 4256 4452 3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe 85 PID 4452 wrote to memory of 4256 4452 3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe 85 PID 4256 wrote to memory of 3572 4256 taskmngr.exe 87 PID 4256 wrote to memory of 3572 4256 taskmngr.exe 87 PID 4256 wrote to memory of 3572 4256 taskmngr.exe 87 PID 3572 wrote to memory of 3824 3572 taskmngr.exe 90 PID 3572 wrote to memory of 3824 3572 taskmngr.exe 90 PID 3572 wrote to memory of 3824 3572 taskmngr.exe 90 PID 3824 wrote to memory of 544 3824 taskmngr.exe 92 PID 3824 wrote to memory of 544 3824 taskmngr.exe 92 PID 3824 wrote to memory of 544 3824 taskmngr.exe 92 PID 544 wrote to memory of 4852 544 taskmngr.exe 93 PID 544 wrote to memory of 4852 544 taskmngr.exe 93 PID 544 wrote to memory of 4852 544 taskmngr.exe 93 PID 4852 wrote to memory of 2700 4852 taskmngr.exe 94 PID 4852 wrote to memory of 2700 4852 taskmngr.exe 94 PID 4852 wrote to memory of 2700 4852 taskmngr.exe 94 PID 2700 wrote to memory of 2336 2700 taskmngr.exe 95 PID 2700 wrote to memory of 2336 2700 taskmngr.exe 95 PID 2700 wrote to memory of 2336 2700 taskmngr.exe 95 PID 2336 wrote to memory of 1844 2336 taskmngr.exe 96 PID 2336 wrote to memory of 1844 2336 taskmngr.exe 96 PID 2336 wrote to memory of 1844 2336 taskmngr.exe 96 PID 1844 wrote to memory of 4372 1844 taskmngr.exe 97 PID 1844 wrote to memory of 4372 1844 taskmngr.exe 97 PID 1844 wrote to memory of 4372 1844 taskmngr.exe 97 PID 4372 wrote to memory of 4984 4372 taskmngr.exe 98 PID 4372 wrote to memory of 4984 4372 taskmngr.exe 98 PID 4372 wrote to memory of 4984 4372 taskmngr.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1196 "C:\Users\Admin\AppData\Local\Temp\3b0ac82e98518d0e7e8f2188d3077987_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1144 "C:\Windows\SysWOW64\taskmngr.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1128 "C:\Windows\SysWOW64\taskmngr.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1124 "C:\Windows\SysWOW64\taskmngr.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1096 "C:\Windows\SysWOW64\taskmngr.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1104 "C:\Windows\SysWOW64\taskmngr.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1152 "C:\Windows\SysWOW64\taskmngr.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1148 "C:\Windows\SysWOW64\taskmngr.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1132 "C:\Windows\SysWOW64\taskmngr.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\taskmngr.exeC:\Windows\system32\taskmngr.exe 1156 "C:\Windows\SysWOW64\taskmngr.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4984
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD53b0ac82e98518d0e7e8f2188d3077987
SHA177dbb003ab39fff4000d9ade701cc338d6b64e3b
SHA256122adb7aca34095fba6a288e07b1ce12192a99c626a2428c8e460eb517a6903a
SHA512dc7ed8b8e2383a6892bdd8461c6031dd82cc9cadcc44baf9795c2481829c0768a097c162ed00a60477d0e927db8caffc6a6da00189a226d2c159e0398421f336