Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe
Resource
win10v2004-20231215-en
General
-
Target
ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe
-
Size
206KB
-
MD5
ea59bdaf93a198d4439630a3cb59c682
-
SHA1
b273af8f29c4aebb99b95f587f3f12a53fa0f0d4
-
SHA256
e465677bc223c5cca8ac7a6d480ff1684f0407c09c251b0ed38c1193659a9947
-
SHA512
6b0ba0bbdf0f4909622f4ff7b1d1a9fb175bd6f1bb1ef2ed84f570d67bd6e1f5654c3f6e650ebc96546b8a3a3646162bdfee2a1c00ade8b5f98f5658cd5823bc
-
SSDEEP
6144:F6Z+4YRtNPB92W4vZ1yldZEjARjQHk1KqkiTqD4FFOPB:F94UtNp9ov8dyMRjQHk1KqkiqDeO5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2956 2728 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2956 2728 ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe 28 PID 2728 wrote to memory of 2956 2728 ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe 28 PID 2728 wrote to memory of 2956 2728 ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe 28 PID 2728 wrote to memory of 2956 2728 ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea59bdaf93a198d4439630a3cb59c682_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 442⤵
- Program crash
PID:2956
-