Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 17:04 UTC

General

  • Target

    f642a88085e9315781c7530b08a03799_JaffaCakes118.exe

  • Size

    46KB

  • MD5

    f642a88085e9315781c7530b08a03799

  • SHA1

    0702d39e230f19f6df26653ec33f0f47cb90fecf

  • SHA256

    47e18d13d3ad1e0ff76e38b06ab89dd1c45c89a0ca0abcc4c2b000785bfc0e18

  • SHA512

    68e13d0606216db4030620737759a0090bb301d398a5acca143f6f65241da9f0dd8b079364d28a9ecc1d13cbc2ae977be7ccf65745f8c2ca492f0c1b8db3a171

  • SSDEEP

    768:8k/Q+BNjwcCPdC9takSFdXJOJha7jHRdK8r+n6XPZHLxycCphOozQZyc5WJlrLGy:8k/QcC+aF1IJw7jTx+n/ciYcc5u

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f642a88085e9315781c7530b08a03799_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f642a88085e9315781c7530b08a03799_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 116
      2⤵
      • Program crash
      PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1976-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/1976-1-0x00000000001B0000-0x00000000001B5000-memory.dmp

    Filesize

    20KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.