Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 10:51
Behavioral task
behavioral1
Sample
62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe
-
Size
56KB
-
MD5
62f188d7ef1d66be7db24b4d3afddf4c
-
SHA1
85b4e6491309d41808ea907b93bd12b5baeb75b6
-
SHA256
b4edddbaf7b83a741cfa2e5681690cb000fd33e13369b5b1dcbb4f5758da3d54
-
SHA512
d829bb7d76394d8cc0307b1f225f3fa5435b2e65a0315ccbfb9750edc35ba06533a7baa5453f28291e42fe0a856135517f799d848187b9961d361e739daf5c41
-
SSDEEP
1536:4sWzeoi4ZFdWiP0D0P4orBKI3WDoX+ga1qvT:KScWWmylUaPa1kT
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2688 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2688 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000c00000001227f-10.dat upx behavioral1/memory/2352-12-0x0000000000190000-0x00000000001CA000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 2688 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2688 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 31 PID 2352 wrote to memory of 2688 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 31 PID 2352 wrote to memory of 2688 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 31 PID 2352 wrote to memory of 2688 2352 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2688
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD58118e4a7c243e8b5e7fb88724477cc3e
SHA1b275f61332753692fc7dc6a21f0584bc037e4cad
SHA256865d1b2c06521676d8fc93d447d72cc3e0e1de87a1441baa77620912ebb79bd5
SHA51227d10928c7e51e69f233c338003569a14456b8ffb8ba2f39aa7f1f6fdfd330307283499a1c4bc6f727861f49865b8d9e6ae92869fce712448ce551f7b4f89534