Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 12:57
Behavioral task
behavioral1
Sample
49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe
-
Size
784KB
-
MD5
49e028e27106fbb46159eecfab42b088
-
SHA1
b3ce18bcf705c287d5c2125bd812a6307001f85b
-
SHA256
05505e24fc4fd6d3f1370a283e8c08a2b79de9846cac30b036c370f5aca1dc05
-
SHA512
7c3962e319b73fc7b0edca49d8c74b462c1b8aef2ea54b4d7cfee111f5e33be1e4e74fda35d195edcb81963feb43beb240799ee84de9cbfda8ab8c0724214f51
-
SSDEEP
12288:fwzQxWq6OznmKRS8PkmbCqAa84DN4Jic6V5Jm7XqxoJJwAwhGLSGZHsyOM06gbh:os4q6OzmIPkmb1zN4JYVLtNhCZMyi6c
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/2740-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2740-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2784-17-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2784-23-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2784-27-0x00000000030F0000-0x0000000003283000-memory.dmp xmrig behavioral1/memory/2784-33-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral1/memory/2784-34-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2740-35-0x0000000003240000-0x0000000003552000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2784 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2784 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2740-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000c00000001227f-10.dat upx behavioral1/memory/2740-15-0x0000000003240000-0x0000000003552000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 2784 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2784 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 32 PID 2740 wrote to memory of 2784 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 32 PID 2740 wrote to memory of 2784 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 32 PID 2740 wrote to memory of 2784 2740 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2784
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD51eaf7aac0b764527ccbd589b102f519d
SHA1bb0fd7f6fa8411f8e7f6ac625e308fe162b9e203
SHA2564e27ee638b2487119215456eb0409572cf815774e06fe84ed6a9f018672c26a1
SHA512e908b6694c7af06367150d17b124bb2110930543a704a297069529ccf67604436e7e135d110d5f4f6accd6e7bbba51cd65aedc23e592a84a35dbdc79ba7b46b8