Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe
-
Size
300KB
-
MD5
ed783966d9683a727ad7b3546f77b594
-
SHA1
a8da804fc3e1cd5d1234d5870d1421515d6cf1cc
-
SHA256
224dadb71bcbe6332da2c1030b11b9aec03f0007d125f2d75e7303dcad015efc
-
SHA512
fbe879dc9c65429059d9d4244b174154b55bda15adae4a6333395838993a1bba994d7cefca6f9fbcc63c46be45619b103c3bf72246f77e1f565b632fb2175f08
-
SSDEEP
6144:RH6xXV7njJG2WmLl8z8ExvjXRvu1iEJYBdgHrz0sDMlbl8weLBBBcvl7oS:RHcR0subjBvu0E8gUCMpCZHeloS
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2504 2748 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2504 2748 ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe 28 PID 2748 wrote to memory of 2504 2748 ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe 28 PID 2748 wrote to memory of 2504 2748 ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe 28 PID 2748 wrote to memory of 2504 2748 ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed783966d9683a727ad7b3546f77b594_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 1922⤵
- Program crash
PID:2504
-