Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe
-
Size
474KB
-
MD5
febf347c736bcb1c6425f4f6afbd74c9
-
SHA1
ea9d9a835d5881554b439c74200a7b86850d10e4
-
SHA256
168dc33e974e2086fcac3a66b904bd57078eb7c8057773500a99e97a16f9ae33
-
SHA512
9fda200f098a772e8b6a401aaaba45a343c6414b97cb4210f22065f37db0a7db481633275ce7365e5d2ce10655dfe515241c7485ff6569b4399a7204f888bffe
-
SSDEEP
12288:TJm0Zinp2PxOfnm/9vNRrnxmzlnwIDDqeagO0l:cRGIO/91RVmzlnwIDDqjgO0l
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2464 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2556 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2464 3004 febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe 30 PID 3004 wrote to memory of 2464 3004 febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe 30 PID 3004 wrote to memory of 2464 3004 febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe 30 PID 3004 wrote to memory of 2464 3004 febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe 30 PID 2464 wrote to memory of 2556 2464 cmd.exe 32 PID 2464 wrote to memory of 2556 2464 cmd.exe 32 PID 2464 wrote to memory of 2556 2464 cmd.exe 32 PID 2464 wrote to memory of 2556 2464 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\febf347c736bcb1c6425f4f6afbd74c9_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2556
-
-