Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 05:29
Static task
static1
Behavioral task
behavioral1
Sample
f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe
-
Size
73KB
-
MD5
f06bbe1de79d323f9e3c3c84791038a6
-
SHA1
7d389c23d207e7527ab7bb0468fc2e3358be2594
-
SHA256
610baffc80f6aa5117301f165f92de339bfd46bd8106b348e9dddeaeba06f1cd
-
SHA512
7603e7b3e6d0464f04f583b3fef9d1ed5e21cd668942ce0d2bdfe6194e57a5804d2615ec9847dcc14f563edc356dd1f0993271b3571a29d7d40f7eb5173af7e5
-
SSDEEP
1536:9W64HFoPLB1us1/0CVCLdiMBXshbZ7+d4Xa2DYVmu+E3IjwvOLO18w00C:X4HqD1/0t8BZad4q2D+my3IjwGy18e
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2320 mdmi386.exe 2740 mdmi386.exe -
Loads dropped DLL 5 IoCs
pid Process 2112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 2112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 2320 mdmi386.exe 2320 mdmi386.exe 2740 mdmi386.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mdmi386.exe f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2320 2112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 28 PID 2112 wrote to memory of 2320 2112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 28 PID 2112 wrote to memory of 2320 2112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 28 PID 2112 wrote to memory of 2320 2112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 28 PID 2320 wrote to memory of 2740 2320 mdmi386.exe 29 PID 2320 wrote to memory of 2740 2320 mdmi386.exe 29 PID 2320 wrote to memory of 2740 2320 mdmi386.exe 29 PID 2320 wrote to memory of 2740 2320 mdmi386.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"4⤵PID:2604
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"5⤵PID:2688
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"6⤵PID:2588
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"7⤵PID:2592
-
-
-
-
-
-
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"1⤵PID:2600
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"2⤵PID:2256
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"3⤵PID:2204
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"4⤵PID:2832
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"5⤵PID:2688
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"6⤵PID:2728
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"7⤵PID:3044
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"8⤵PID:2800
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"9⤵PID:2564
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"10⤵PID:1712
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"11⤵PID:2476
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"12⤵PID:2724
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"13⤵PID:2624
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"14⤵PID:2664
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"15⤵PID:2484
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"16⤵PID:2748
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"17⤵PID:2124
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"18⤵PID:2904
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"19⤵PID:2704
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"20⤵PID:2712
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"21⤵PID:2436
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"22⤵PID:2744
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"23⤵PID:2528
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"24⤵PID:2596
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"25⤵PID:2828
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"26⤵PID:1948
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"27⤵PID:2536
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"28⤵PID:2920
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"29⤵PID:308
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"30⤵PID:2000
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"31⤵PID:2208
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"32⤵PID:2448
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"33⤵PID:1760
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"34⤵PID:644
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"35⤵PID:2648
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"36⤵PID:2236
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"37⤵PID:1980
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"38⤵PID:2344
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"39⤵PID:1952
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"40⤵PID:1764
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"41⤵PID:1284
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"42⤵PID:2140
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"43⤵PID:2264
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"44⤵PID:2300
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"45⤵PID:1800
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"46⤵PID:1064
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"47⤵PID:2308
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"48⤵PID:2636
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"49⤵PID:2128
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"50⤵PID:1924
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"51⤵PID:536
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"52⤵PID:1504
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"53⤵PID:1492
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"54⤵PID:292
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"55⤵PID:1076
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"56⤵PID:1796
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"57⤵PID:1704
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"58⤵PID:1108
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"59⤵PID:876
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"60⤵PID:604
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"61⤵PID:1540
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"62⤵PID:2052
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"63⤵PID:2168
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"64⤵PID:1548
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"65⤵PID:2428
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"66⤵PID:892
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"67⤵PID:2864
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"68⤵PID:1936
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"69⤵PID:2336
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"70⤵PID:668
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"71⤵PID:2844
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"72⤵PID:1932
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"73⤵PID:928
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"74⤵PID:2872
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"75⤵PID:956
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"76⤵PID:1792
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"77⤵PID:2116
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"78⤵PID:580
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"79⤵PID:360
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"80⤵PID:1808
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"81⤵PID:564
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"82⤵PID:2200
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"83⤵PID:1012
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"84⤵PID:2816
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"85⤵PID:1616
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"86⤵PID:1352
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"87⤵PID:1740
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"88⤵PID:344
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"89⤵PID:2212
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"90⤵PID:1620
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"91⤵PID:2660
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"92⤵PID:2940
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"93⤵PID:1512
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"94⤵PID:2256
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"95⤵PID:2696
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"96⤵PID:1200
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"97⤵PID:2280
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"98⤵PID:2688
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"99⤵PID:2560
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"100⤵PID:2592
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"101⤵PID:2564
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"102⤵PID:2656
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"103⤵PID:2708
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"104⤵PID:2908
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"105⤵PID:2484
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"106⤵PID:2748
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"107⤵PID:2016
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"108⤵PID:2492
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"109⤵PID:1036
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"110⤵PID:2712
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"111⤵PID:2752
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"112⤵PID:2436
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"113⤵PID:2524
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"114⤵PID:2792
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"115⤵PID:2260
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"116⤵PID:2508
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"117⤵PID:1948
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"118⤵PID:1668
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"119⤵PID:1736
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"120⤵PID:2680
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"121⤵PID:2448
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"122⤵PID:320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-