Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 07:04

General

  • Target

    00169ea6e3ce70bddfda6c5befda3084_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    00169ea6e3ce70bddfda6c5befda3084

  • SHA1

    4929f2714815c86f4e8d55fe40129501ae167eaa

  • SHA256

    ad2b4ffeb87fa58af474e931cfc4271b473a36ec46945e61263e983fa21c502a

  • SHA512

    7817328af2164029d6d53350f805cbf32f45a5feb989f7025123017160ba2f38253eb25eae689c7c643fbb7760341ce6098611775f7ed20f2a913ce8a7cba9fc

  • SSDEEP

    24576:6tnn98igOKptGDwPffv3Xp+vlrUCr2Rze0HSnlhgsvR98RW:6NXgOKpwGffvJ+RU6WeASnlz9k

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084_JaffaCakes118.exe

    Filesize

    1.5MB

    MD5

    8f50cffce55744f894d0848534924d59

    SHA1

    3f343e5e1a1c187ac0d7a49806e778d810baa1de

    SHA256

    d472b535b9a8092bf4652045d6e848f275ac2c42f9ac46e06a168023147c7306

    SHA512

    a011d94a08ecf88ef03874b1925b48e22af2bf5085cedc7a35569b14fa0fe12265913819f2c628724336de1735231af8f1f66e49f1f41c70eb254db8e3456540

  • memory/2096-13-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2096-20-0x00000000044F0000-0x000000000471A000-memory.dmp

    Filesize

    2.2MB

  • memory/2096-19-0x0000000001BF0000-0x0000000001D23000-memory.dmp

    Filesize

    1.2MB

  • memory/2096-15-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2096-21-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/2096-33-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/4668-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/4668-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

    Filesize

    1.2MB

  • memory/4668-12-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/4668-2-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB