Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe
-
Size
707KB
-
MD5
f11f4b77e753d376fdc2526d88e15e74
-
SHA1
451b78624055a94f5390b6c1d5772bc8ffe3f061
-
SHA256
7002c54c1425d85fc7574ac718272076178852668c70400afcb903c83a0375db
-
SHA512
715e1146a9761df7ec2fe0171f46002e7feaa496ae46e0ffd9213cf27ceba7b8c7b40fd870707117ac740a78f3d96bd4030071c3128500321acfb15b0b42fb99
-
SSDEEP
12288:0xEVBEu4+lz5y/GazAH8yX3dz5R0NVeaHWEORU:nVK4yfzAPndFR0N4aUu
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2524 svchost.exe 2524 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2972 wrote to memory of 2524 2972 f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe 28 PID 2524 wrote to memory of 1176 2524 svchost.exe 20 PID 2524 wrote to memory of 1176 2524 svchost.exe 20 PID 2524 wrote to memory of 1176 2524 svchost.exe 20 PID 2524 wrote to memory of 1176 2524 svchost.exe 20 PID 2524 wrote to memory of 1176 2524 svchost.exe 20 PID 2524 wrote to memory of 1248 2524 svchost.exe 21 PID 2524 wrote to memory of 1248 2524 svchost.exe 21 PID 2524 wrote to memory of 1248 2524 svchost.exe 21 PID 2524 wrote to memory of 1248 2524 svchost.exe 21 PID 2524 wrote to memory of 1248 2524 svchost.exe 21
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f11f4b77e753d376fdc2526d88e15e74_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524
-
-