Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe
Resource
win10v2004-20240319-en
General
-
Target
23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe
-
Size
188KB
-
MD5
23411f1773f79bf4fa635caec3a02706
-
SHA1
124cdea0e5e1da32990853371d1b6e2a72ee2976
-
SHA256
b1e16aa6e650cb22eb07e09523e924f6296be8f9582bda5c7cb6476a3724fe82
-
SHA512
805cf0cb5a0dd2e93edee811b0785fc79c43d22c44c00eceeb0a826bd680b88804682e461659cd5fe4bb61ab42a32c5ff208c01ef7a73a51b044c30c4f655010
-
SSDEEP
3072:39N3o01azDkvOjsdTIi6zIbkUN6cWZmnYUx9DP1D7lSdpFp:39hoxHkvrdMi6zbg9l7lSdpF
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2960 2772 WerFault.exe 27 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2772 23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2960 2772 23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe 28 PID 2772 wrote to memory of 2960 2772 23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe 28 PID 2772 wrote to memory of 2960 2772 23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe 28 PID 2772 wrote to memory of 2960 2772 23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\23411f1773f79bf4fa635caec3a02706_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 2402⤵
- Program crash
PID:2960
-