Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe
-
Size
180KB
-
MD5
fdcc6f2ad2976c96d29f794cb183396d
-
SHA1
84ada11b0f8ae09d1fa3ad8319d5949bdf531b30
-
SHA256
a1f57f4ea32b2cee38cdf59a50d5062b56b4fc6bcbe81ffb746467f25ed4c94b
-
SHA512
824b335291bb3406b1f7c6b6fd63dea99cc827a5fa56ebe0fe7f5b66edb1d65434afd10d8693399bb2ed14d28dd68aa4e97032ec9dc5c1272a7a5308da92b432
-
SSDEEP
3072:PFnhBS/HHm8/b+SHiM0CrLISfH0/JPExZk82xvDN4DVxxLb:PFnhAmkb5CM04ISfU/Jcxa86DN6LX
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2344 1700 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2344 1700 fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe 28 PID 1700 wrote to memory of 2344 1700 fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe 28 PID 1700 wrote to memory of 2344 1700 fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe 28 PID 1700 wrote to memory of 2344 1700 fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdcc6f2ad2976c96d29f794cb183396d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 842⤵
- Program crash
PID:2344
-