Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 12:57
Behavioral task
behavioral1
Sample
49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe
-
Size
784KB
-
MD5
49e028e27106fbb46159eecfab42b088
-
SHA1
b3ce18bcf705c287d5c2125bd812a6307001f85b
-
SHA256
05505e24fc4fd6d3f1370a283e8c08a2b79de9846cac30b036c370f5aca1dc05
-
SHA512
7c3962e319b73fc7b0edca49d8c74b462c1b8aef2ea54b4d7cfee111f5e33be1e4e74fda35d195edcb81963feb43beb240799ee84de9cbfda8ab8c0724214f51
-
SSDEEP
12288:fwzQxWq6OznmKRS8PkmbCqAa84DN4Jic6V5Jm7XqxoJJwAwhGLSGZHsyOM06gbh:os4q6OzmIPkmb1zN4JYVLtNhCZMyi6c
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/memory/3648-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3648-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/928-16-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/928-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/928-29-0x0000000005340000-0x00000000054D3000-memory.dmp xmrig behavioral2/memory/928-30-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral2/memory/928-31-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 928 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 928 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3648-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000e000000023467-11.dat upx behavioral2/memory/928-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3648 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3648 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 928 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3648 wrote to memory of 928 3648 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 85 PID 3648 wrote to memory of 928 3648 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 85 PID 3648 wrote to memory of 928 3648 49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\49e028e27106fbb46159eecfab42b088_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:928
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5a5cf75461e52fb588bb3bf0841134c70
SHA12f6b5a92cbe165c2e061c00800fb3f9aa3ba69aa
SHA256c3816cfaf7e654cb841beeb5052b0fd1575d2c0f968024b10a1b2a78af94720c
SHA5123c9f0f9c5eb3b44f9cadede3a43bd79bb6f6a9d3a14c093985eec6ccb2b2b72e746f30de6e06bf3627d2bc1bebd5d87b78b8568ea24018ee85be8265444dc3d5