Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe
-
Size
301KB
-
MD5
4b5c8defebf2691452b7209e25d6ec02
-
SHA1
a514c2ffe1dd1fcaae9bf94d55ea1897b777c185
-
SHA256
8ad3f3fa525f4dfc045e74d3cc6534aa187ddf7fa1c60b66b800f665d1a3d650
-
SHA512
f5db66caa03ed698dfa2b5d797987a092beee33f2942bddb311425bcdf4fc529cb30aa58d1e286d220b450ffb36bee3059ade514403ed2a89d7942de0357d883
-
SSDEEP
6144:fJEYERqaQiEYixXAkmOgoUpMEEdlntRb5A+na4S35EQwa:h5+qntJxjfg5mxdltZ5A+na4RQwa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1048 svohst.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\Deleteme.bat svohst.exe File created C:\Windows\SysWOW64\Deleteme.bat 4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe File created C:\Windows\SysWOW64\svohst.exe 4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\svohst.exe 4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe File created C:\Windows\SysWOW64\svohst.exe svohst.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1048 wrote to memory of 4988 1048 svohst.exe 87 PID 1048 wrote to memory of 4988 1048 svohst.exe 87 PID 1048 wrote to memory of 4988 1048 svohst.exe 87 PID 1392 wrote to memory of 4692 1392 4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe 89 PID 1392 wrote to memory of 4692 1392 4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe 89 PID 1392 wrote to memory of 4692 1392 4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b5c8defebf2691452b7209e25d6ec02_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵PID:4692
-
-
C:\Windows\SysWOW64\svohst.exeC:\Windows\SysWOW64\svohst.exe -NetSata1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat2⤵PID:4988
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212B
MD506a0d658c32c18f494a397f6a571e949
SHA119e0c0757d8852e6d21b18036af0115f0bab59f5
SHA256db03845571b8da589b4880f9db7c93fb93a37848bd2c350d90ec90656197fa77
SHA512fb7647145f4d7df0db93b7d2a0af4ac66f37c01415597e57a0978e53e0ef1bb400593079cd886b8969612c596e3daa42f43701ac1205d6b65642164801a2997c
-
Filesize
104B
MD52eec7e3ae21b6acc8fb8cf0a2f7323aa
SHA10e6a8a87b7c2848ffec860a6955a44a2c166ad9b
SHA25678d9742426f406d30f8379f240e595b8ab937b48bc9b0b5099e7e9ecfaa9fac2
SHA512e13fae2b008a4eb4b88ade4e516d8c8d2521c1c88b53fd4f62863673ade296e708c5b128f1b5b79b18d78f0ed3c94a892207841b664c057a2617ab97aa8bf281
-
Filesize
301KB
MD54b5c8defebf2691452b7209e25d6ec02
SHA1a514c2ffe1dd1fcaae9bf94d55ea1897b777c185
SHA2568ad3f3fa525f4dfc045e74d3cc6534aa187ddf7fa1c60b66b800f665d1a3d650
SHA512f5db66caa03ed698dfa2b5d797987a092beee33f2942bddb311425bcdf4fc529cb30aa58d1e286d220b450ffb36bee3059ade514403ed2a89d7942de0357d883