Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
-
Size
63KB
-
MD5
f1fad2961ed4f61b85a1c90ccc14dab9
-
SHA1
d2dd89e9be79af3ce8c0ff77c390f0718421ca32
-
SHA256
55824d3e2b4d1179db305025a448310d7e0496257e6a8d3c502aa1ce5ef53655
-
SHA512
4343b10ddb54b32198839044498f14a36e0e2d19ffb69b41da477d3f58fcc4998233648bdd2d39c7ce2453ee0b060dfdc6829f60840f5979a901e12a9cb58ade
-
SSDEEP
768:9FFAaEs6GQ4uLFL11zR5ECLkqdimKL7wJ6QM0meicl9b6GvoQsZ3bZ5:9NQBP1z8ykqgR/QM1cl9+GvoQ+bZ5
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2956 set thread context of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28 PID 2956 wrote to memory of 764 2956 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe2⤵PID:764
-