Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2024, 16:48
Static task
static1
1 signatures
General
-
Target
JaffaCakes118_2959c2846b11df0d47323f8d1e60fdfc.exe
-
Size
432KB
-
MD5
2959c2846b11df0d47323f8d1e60fdfc
-
SHA1
37115ebdf90ed9588ccd9f4f30cf20b9395de6b4
-
SHA256
c0fb277b0fa49f48913db791944ab13998d89a1099d6ae1dbbd19d5ba2b4b423
-
SHA512
e032359c1fe79c4d416b4b6d9c79cbd34277dc613792c4acd56796880f0bb565c0d57966a8a3d0dfa8696005b6b93cb0bc468d2e6a8beddaf9ca748f7c91d07d
-
SSDEEP
12288:yUCmZiCa0mUy9wrb8DCiMF2oWl5uXMISFgiMjONnXz5pidT95L5iq:4Ca0qwr8ahYucIz1je1patiq
Malware Config
Signatures
-
Expiro family
-
Expiro payload 4 IoCs
resource yara_rule behavioral1/memory/3568-0-0x0000000000240000-0x00000000002D4000-memory.dmp family_expiro1 behavioral1/memory/3568-1-0x00000000001D0000-0x00000000002D4000-memory.dmp family_expiro1 behavioral1/memory/3568-2-0x0000000000240000-0x00000000002D4000-memory.dmp family_expiro1 behavioral1/memory/3568-3-0x00000000001D0000-0x00000000002D4000-memory.dmp family_expiro1 -
Program crash 1 IoCs
pid pid_target Process procid_target 392 3568 WerFault.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2959c2846b11df0d47323f8d1e60fdfc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2959c2846b11df0d47323f8d1e60fdfc.exe"1⤵PID:3568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 2002⤵
- Program crash
PID:392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3568 -ip 35681⤵PID:1996