Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 12:41
Behavioral task
behavioral1
Sample
f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
-
Size
223KB
-
MD5
f3858fba9f17e014f305d1caaa7cb250
-
SHA1
b2ce2feb2ab7f40740ad9886ae4cc95a16568a2b
-
SHA256
3f6eddf63e8e09988a1ca46ed6497e8efc7bed35c1098525427b5ab67e6e09d1
-
SHA512
eaff4fc56d29ac55c63a116c6e85d5b84c21342b40a256dcb647767742794de23f47d6098355997fbd7e12cd926c13d75c0d32abd4f1549aba3f32e7487fc64b
-
SSDEEP
3072:blN9RkkkkkkTLqDX3E6ValN9RkkkkkkTLqDX3E6VNCyeDe:5dkkkkkkuJMdkkkkkkuJz
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1632-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-1-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/files/0x0031000000014454-6.dat upx behavioral1/memory/1632-18-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-19-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-20-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-21-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-22-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-23-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-24-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-25-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-26-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-27-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-28-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-29-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1632-30-0x0000000000400000-0x0000000000423000-memory.dmp upx -
Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\win32dc\FlatOut_cheat.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\DAoC + codes.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File opened for modification C:\Windows\win32dc\BattleField 1942 nocd.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File opened for modification C:\Windows\win32dc\Silent Hill 4_serial.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File opened for modification C:\Windows\win32dc\Quake3 crack.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File opened for modification C:\Windows\win32dc\Half-Life 2 patch.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\BattleField 1942 nocd.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\Silent Hill 4_serial.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\FlatOut_cheat.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\Quake3 crack.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\Silent Hill 4_hack.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\Half-Life 2 codes.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File opened for modification C:\Windows\win32dc\DAoC + codes.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\Half-Life 2 patch.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\BattleField 1942(cheat).exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe File created C:\Windows\win32dc\UT2004 + codes.exe f3858fba9f17e014f305d1caaa7cb250_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD51ed0206e9d5c5a63cac8b033bdebd7ec
SHA167a0640e2163585dc1b1e914f5effe1cd4199814
SHA2564b86753021d3ba26c4b427c240160255f1b7c71f78a885a80328717940906d48
SHA5124baf6d2ef91280e1b5cebcbd16b94b9d7615cb76a2fe506b6e890b238ddd31bf61bfe6d400857dc02fba40accecca05e84f4011608ab63751062059783bf9c7d