Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe
-
Size
63KB
-
MD5
f1fad2961ed4f61b85a1c90ccc14dab9
-
SHA1
d2dd89e9be79af3ce8c0ff77c390f0718421ca32
-
SHA256
55824d3e2b4d1179db305025a448310d7e0496257e6a8d3c502aa1ce5ef53655
-
SHA512
4343b10ddb54b32198839044498f14a36e0e2d19ffb69b41da477d3f58fcc4998233648bdd2d39c7ce2453ee0b060dfdc6829f60840f5979a901e12a9cb58ade
-
SSDEEP
768:9FFAaEs6GQ4uLFL11zR5ECLkqdimKL7wJ6QM0meicl9b6GvoQsZ3bZ5:9NQBP1z8ykqgR/QM1cl9+GvoQ+bZ5
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4616 set thread context of 2900 4616 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 85 -
Program crash 1 IoCs
pid pid_target Process procid_target 4024 2900 WerFault.exe 85 -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2900 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4616 wrote to memory of 2900 4616 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 85 PID 4616 wrote to memory of 2900 4616 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 85 PID 4616 wrote to memory of 2900 4616 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 85 PID 4616 wrote to memory of 2900 4616 f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f1fad2961ed4f61b85a1c90ccc14dab9_JaffaCakes118.exe2⤵
- Suspicious use of UnmapMainImage
PID:2900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 123⤵
- Program crash
PID:4024
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2900 -ip 29001⤵PID:5288