Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
425b65792c2b2e116415734d562bb77d
-
SHA1
35e4ee3d979125c7ae8e76c6d6c5cbd797c04b5a
-
SHA256
9ed7625e9239521cad4d0954d54d16338cae54c14f88a47bd515258f2d3966d3
-
SHA512
d1a3a6b7f9bce0186cc99d2540b9a811fd2a270885b67bfcd0ec11acc784b3298dbaf3a84a6d68d74e8db516a02aa3128063585149399ef9245932230b25757d
-
SSDEEP
24576:PsRkEMK0WC4yUbFQnXPan6v5cXO0AtT7gxp0K/kkKjZeCmheJ:PaMlz2unHcO0AhUWk+m6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4460 ProxifierSetup.exe 2188 is-22043.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1160 wrote to memory of 4460 1160 425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe 83 PID 1160 wrote to memory of 4460 1160 425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe 83 PID 1160 wrote to memory of 4460 1160 425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe 83 PID 4460 wrote to memory of 2188 4460 ProxifierSetup.exe 85 PID 4460 wrote to memory of 2188 4460 ProxifierSetup.exe 85 PID 4460 wrote to memory of 2188 4460 ProxifierSetup.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\425b65792c2b2e116415734d562bb77d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\ProxifierSetup.exe"C:\Users\Admin\AppData\Local\Temp\ProxifierSetup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\is-VH5GF.tmp\is-22043.tmp"C:\Users\Admin\AppData\Local\Temp\is-VH5GF.tmp\is-22043.tmp" /SL4 $501FC "C:\Users\Admin\AppData\Local\Temp\ProxifierSetup.exe" 632776 527363⤵
- Executes dropped EXE
PID:2188
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
849KB
MD5026abd6f7fb37f6b7d81ddfaa6057649
SHA138115d589831b33ac0469b6244192ac49817ad23
SHA2560dca720636bd7dc0da475c3eeadef1415aacaf0f1cfb09c35f4d3dd4bbf6909e
SHA5120566285b7dff2cf2957fa5fab99055daa57be3e689f7980fe17f09eb83815d66c955bfa3af3ce423144f9ac17b2738c96efa426b87de155cfd0d6754e40d77b5
-
Filesize
658KB
MD5f627721a34c13a5307779a498e8f6519
SHA19e54ec07e780eb1ccbbd61bb1a24238e46c01e18
SHA25613c6a795a259a9731d5c00f35e6eeeeae840423d3e1783fd6c75509a3b7cb348
SHA512c2dc88b441539b8827f0ef2a4c6b404cebaa5452d884d0174a2447347a462552f47a9d6521ecfa660cd9f0e0771fc192438865dcda305ab373c6f9a0c694aecc