Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
ecc399cf0308c132c64858d080edfe65
-
SHA1
65fe488ba1da76d9b73f15c35b37b89556329948
-
SHA256
1c2a718b83718df5a8a7c28f46fae880e61abc788b514c22f538bd64f49cc1e9
-
SHA512
51d7c49ce1d8d65b74af957f831b9d7dafa847a2fb313f672f14a5829f2f47a827ce4a2906b962c1fbdfe5a78417767474a7fb25eb9d87f40ee9c711f80d7d70
-
SSDEEP
24576:cYk/ATPSCcqZrE/P1aet4l1R5/TX7E/X0Dp7wG:c5oTKl4ZvRNTX78X0DpM
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe" ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2872 ecc399cf0308c132c64858d080edfe65_JaffaCakes118.exe