Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 17:28

General

  • Target

    3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe

  • Size

    517KB

  • MD5

    3a14de3dd3dd030c7c0691d65d06d37a

  • SHA1

    14d445be7952829cdbe6e27c8748af323ea9c884

  • SHA256

    3fd7a8cc872d80283145f476fa52d5eb118ebf064a2f5b9b9bb3fcfc680c75db

  • SHA512

    faa745a2d81f456fbef4dc1df850e7a9d5bf8e4b960f5fe7cfecc3b5ead6d6c695f597cab9f390b54ccc1be17b41b9efb709e3a803a4ca127a2d369308ea2b87

  • SSDEEP

    6144:5hvDJNqNYsYsG8amnHQH7tgS4bzhWU6OSh5YOqOZEt9zDHgo8hSoz5YCZh6TIy8p:5R70Yw7HHAub859qGGNDAHhhz5ZF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Program Files\Java\jre-1.8\launch4j-tmp\3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe
      "C:\Program Files\Java\jre-1.8\launch4j-tmp\3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe" -jar "C:\Users\Admin\AppData\Local\Temp\3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Java\jre-1.8\launch4j-tmp\3a14de3dd3dd030c7c0691d65d06d37a_JaffaCakes118.exe

    Filesize

    285KB

    MD5

    7fb44c5bca4226d8aab7398e836807a2

    SHA1

    47128e4f8afabfde5037ed0fcaba8752c528ff52

    SHA256

    a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef

    SHA512

    f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab

  • memory/3212-3-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB