Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
49de539757328d291a2835e4a33e1048_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
49de539757328d291a2835e4a33e1048_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49de539757328d291a2835e4a33e1048_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
49de539757328d291a2835e4a33e1048
-
SHA1
cdf81075fbcc050ab99d596afcb24321d14ef93a
-
SHA256
06d4f1cf0fcaaf2640e5a75d55f8d60043330edadae1a19eb361e5cb5b0d05ed
-
SHA512
ca28d8bfedff923f28a48dae8da6472bb3629c6d0116e429ce6f8e3aca842d907a252c5badd04198fd8089f187000281a4d67543c6ad1030d6e3a53ad6f756d8
-
SSDEEP
98304:dUk0lrjpulSbAn4st9W5QhllTnRE2O2NUj1Zyv/Sf1EVO3S5:dWlpu5U5yzW25N8Zq/S9PS5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2312 49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp -
Loads dropped DLL 4 IoCs
pid Process 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 2312 49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp 2312 49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp 2312 49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2312 49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30 PID 2492 wrote to memory of 2312 2492 49de539757328d291a2835e4a33e1048_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\49de539757328d291a2835e4a33e1048_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49de539757328d291a2835e4a33e1048_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\is-4EAOI.tmp\49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp"C:\Users\Admin\AppData\Local\Temp\is-4EAOI.tmp\49de539757328d291a2835e4a33e1048_JaffaCakes118.tmp" /SL5="$400F4,4146341,140800,C:\Users\Admin\AppData\Local\Temp\49de539757328d291a2835e4a33e1048_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2312
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5d28fafbc2649637378521f52088fb423
SHA10be6ec4098c8e6e48e59d05c880d066dd8f07d27
SHA256084f343aadfe3c3b31e4671710e2b8ee670ea09977caca1fb1d6f403c9ecd734
SHA5120ffa843913d153d6723cf84b0d367b54851b396fb49247ad00cd711b1ff0e039a1032fdce0f99d8c0349e4ed48bd40df05437a751967028c85247350ee647ba0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.1MB
MD5394289faec0a43faea574588cb367018
SHA1b02982a816782c3c16ad5a321dce0a79cab124a2
SHA25689c8d27247ff86f189ebba01e27c47daa184a04c5f002130f9d336ca80d71202
SHA512e99977ed9b3ea6607d347fe3e339cff40e70166db6a93443046cb7e0bc2a6f7c598503a55030f7d9ae0e8ede8b706bb4bd682bbdadf215641247b96bae0d09f4