Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 10:51
Behavioral task
behavioral1
Sample
62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe
-
Size
56KB
-
MD5
62f188d7ef1d66be7db24b4d3afddf4c
-
SHA1
85b4e6491309d41808ea907b93bd12b5baeb75b6
-
SHA256
b4edddbaf7b83a741cfa2e5681690cb000fd33e13369b5b1dcbb4f5758da3d54
-
SHA512
d829bb7d76394d8cc0307b1f225f3fa5435b2e65a0315ccbfb9750edc35ba06533a7baa5453f28291e42fe0a856135517f799d848187b9961d361e739daf5c41
-
SSDEEP
1536:4sWzeoi4ZFdWiP0D0P4orBKI3WDoX+ga1qvT:KScWWmylUaPa1kT
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3680 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3680 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/1508-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000800000002344a-11.dat upx behavioral2/memory/3680-13-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1508 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1508 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 3680 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1508 wrote to memory of 3680 1508 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 87 PID 1508 wrote to memory of 3680 1508 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 87 PID 1508 wrote to memory of 3680 1508 62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\62f188d7ef1d66be7db24b4d3afddf4c_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3680
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD57cc0bf82df1aef3adc282ffb8f9490c2
SHA1d9e322a86e7498a5816df867e65ba38b4049bfa4
SHA2569f34ea60682040a6ab3d888177024e4bf2f92ba9fd0d42edacea0708ae446b4f
SHA512afad5110b65737497cc5702640b26a12092fdba59920a285b8c2c6d07b5e7c9bcc7cf0aea2e07516234f9fed5a16a7c971373dab3e57410dc45f3554a18c2e28