Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe
-
Size
488KB
-
MD5
f6080fdcfdf141fa9b590892c61a0ac7
-
SHA1
9ae80dd0d9679cb435c90c56b3a98c5b2f213ea2
-
SHA256
9388efda339f0e2f7b436f7a63efee484d3e02ac6caa0f1caa8417525bdb8400
-
SHA512
0059863778ba8260cb70930e1b76e48159b2731cbdc0614af85f6825438e82e4210e94be0e65cd2d26570aa8a4f05409fdfe4dbe701fd506efac3587d95ca571
-
SSDEEP
12288:FytbV3kSoXaLnToslRdrNjHkZrIrYCYUVrPMO:Eb5kSYaLTVlRdZjESVrkO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2240 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1684 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2172 f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe 2172 f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2172 f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2240 2172 f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe 30 PID 2172 wrote to memory of 2240 2172 f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe 30 PID 2172 wrote to memory of 2240 2172 f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe 30 PID 2240 wrote to memory of 1684 2240 cmd.exe 32 PID 2240 wrote to memory of 1684 2240 cmd.exe 32 PID 2240 wrote to memory of 1684 2240 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\f6080fdcfdf141fa9b590892c61a0ac7_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:1684
-
-