Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 06:18

General

  • Target

    be0b6b83341f86e397396b2572bcc070_JaffaCakes118.exe

  • Size

    56KB

  • MD5

    be0b6b83341f86e397396b2572bcc070

  • SHA1

    85328f51b1fb8d5b74c3f117c20cc17d58d801cc

  • SHA256

    c2d86a5a285637c6c13b7218a25f46f3431be485f3c895c6234242feb6b69c7d

  • SHA512

    a4c67ee51a1ceaf28d4f1286fb4325d51cb4dbcd3f9f0821790c4c6dcba16df17cc4b21175d463415c30d451d306761b807218b685873a51d2fcb4a56a16e6ce

  • SSDEEP

    1536:Yithg+ducy6r6tRxniu2KsOadDS8s34ljDU10Rf:lXur6hfjVhDz

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be0b6b83341f86e397396b2572bcc070_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\be0b6b83341f86e397396b2572bcc070_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Users\Admin\AppData\Local\Temp\be0b6b83341f86e397396b2572bcc070_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\be0b6b83341f86e397396b2572bcc070_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\be0b6b83341f86e397396b2572bcc070_JaffaCakes118.exe

    Filesize

    56KB

    MD5

    ed82c419e7009b1025924b70d36d686b

    SHA1

    0f7ad2a1a614763bae635f9125ecf235a95cef2a

    SHA256

    bbc43e6004c7435c5d3c6f5e12e3d443026cc4d8bea8e6b55b80a5e257467444

    SHA512

    6fa4a66c88fb9bb3d0ce0405569c2cc342b33019bff7f7006f42d2d43edb422534b1ad70cc01ca8023bb216a65391c941f5cfcb03e0068a7b3619a046156ddcd

  • memory/700-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/700-1-0x00000000001C0000-0x00000000001CE000-memory.dmp

    Filesize

    56KB

  • memory/700-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/700-11-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4928-13-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4928-14-0x00000000000C0000-0x00000000000CE000-memory.dmp

    Filesize

    56KB

  • memory/4928-15-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4928-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4928-25-0x00000000015A0000-0x00000000015BB000-memory.dmp

    Filesize

    108KB

  • memory/4928-26-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB