Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 21:01
Static task
static1
Behavioral task
behavioral1
Sample
0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe
-
Size
42KB
-
MD5
0010cf3e5fd0ee12564d3362401f7923
-
SHA1
5bc3075527bcd1b562765e4289bd8cda5f995336
-
SHA256
cb337c3be3fb831848287f3ff7c984b4b89907b9321fc88ce8642febc195d11f
-
SHA512
53a954da500bbd6c8b920bbe1da0eab175a166b2b5e4ad33715156831a72e68aed30121548dff434a523ec1f4678e613e075e39ff602b339b5b8ac1729300e3b
-
SSDEEP
768:KOxZOgIryM1P3oO2y8UN2ivcTTJlu71TFA9nn0OjDDdmo/SK2OURvXZzOmRkNRdZ:nSgy19JSVO1ONn511/tivXZzOmRk1jt
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1468 bhhttn.exe 760 1vpvj.exe 2388 nbtthn.exe 3004 thhbnh.exe 2608 pjdjp.exe 2692 xrxflxr.exe 2756 7bntbh.exe 2100 vvvjv.exe 2508 1lrflrf.exe 2524 tnbnnt.exe 2764 ppjpj.exe 2204 9rflxrf.exe 840 lrfrxlf.exe 2708 hththn.exe 1996 ddvvv.exe 1756 pjjdd.exe 764 rrllrff.exe 936 hnhnth.exe 2784 ppvvd.exe 1904 rlfxflr.exe 1716 rrflllx.exe 2120 nbttnn.exe 2852 1tnhnt.exe 1088 pdvpd.exe 2340 flxllxx.exe 540 hnhtnt.exe 1020 ddjpp.exe 660 xxxlfxl.exe 1816 hhthth.exe 1916 1ppvd.exe 2448 rlxfllx.exe 2896 htntnn.exe 1976 bbtbhn.exe 980 jdpvj.exe 1452 7llxlrf.exe 2320 3nnnbn.exe 1192 5jvjv.exe 700 xxrxxxl.exe 2408 lfrxlrx.exe 1184 hbnnhh.exe 2864 9jpvv.exe 1016 5dvdj.exe 1740 ttnnnt.exe 2996 tnhnht.exe 1596 rlfrflx.exe 1572 htbbtt.exe 1932 hthbtt.exe 2400 vvvpd.exe 2560 xlrlllr.exe 2024 frxffff.exe 2624 nhtbnt.exe 2620 7dppp.exe 2700 lflrrxf.exe 2696 llfxffr.exe 2668 bnnttt.exe 2488 pdppv.exe 2520 xllxxrf.exe 2600 lfflrrx.exe 2532 nhntbb.exe 3060 jdddd.exe 2964 3xrllff.exe 940 rlllrxf.exe 1712 nbhbbb.exe 1928 9tntnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1468 2012 0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe 28 PID 2012 wrote to memory of 1468 2012 0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe 28 PID 2012 wrote to memory of 1468 2012 0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe 28 PID 2012 wrote to memory of 1468 2012 0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe 28 PID 1468 wrote to memory of 760 1468 bhhttn.exe 29 PID 1468 wrote to memory of 760 1468 bhhttn.exe 29 PID 1468 wrote to memory of 760 1468 bhhttn.exe 29 PID 1468 wrote to memory of 760 1468 bhhttn.exe 29 PID 760 wrote to memory of 2388 760 1vpvj.exe 30 PID 760 wrote to memory of 2388 760 1vpvj.exe 30 PID 760 wrote to memory of 2388 760 1vpvj.exe 30 PID 760 wrote to memory of 2388 760 1vpvj.exe 30 PID 2388 wrote to memory of 3004 2388 nbtthn.exe 31 PID 2388 wrote to memory of 3004 2388 nbtthn.exe 31 PID 2388 wrote to memory of 3004 2388 nbtthn.exe 31 PID 2388 wrote to memory of 3004 2388 nbtthn.exe 31 PID 3004 wrote to memory of 2608 3004 thhbnh.exe 32 PID 3004 wrote to memory of 2608 3004 thhbnh.exe 32 PID 3004 wrote to memory of 2608 3004 thhbnh.exe 32 PID 3004 wrote to memory of 2608 3004 thhbnh.exe 32 PID 2608 wrote to memory of 2692 2608 pjdjp.exe 33 PID 2608 wrote to memory of 2692 2608 pjdjp.exe 33 PID 2608 wrote to memory of 2692 2608 pjdjp.exe 33 PID 2608 wrote to memory of 2692 2608 pjdjp.exe 33 PID 2692 wrote to memory of 2756 2692 xrxflxr.exe 34 PID 2692 wrote to memory of 2756 2692 xrxflxr.exe 34 PID 2692 wrote to memory of 2756 2692 xrxflxr.exe 34 PID 2692 wrote to memory of 2756 2692 xrxflxr.exe 34 PID 2756 wrote to memory of 2100 2756 7bntbh.exe 35 PID 2756 wrote to memory of 2100 2756 7bntbh.exe 35 PID 2756 wrote to memory of 2100 2756 7bntbh.exe 35 PID 2756 wrote to memory of 2100 2756 7bntbh.exe 35 PID 2100 wrote to memory of 2508 2100 vvvjv.exe 36 PID 2100 wrote to memory of 2508 2100 vvvjv.exe 36 PID 2100 wrote to memory of 2508 2100 vvvjv.exe 36 PID 2100 wrote to memory of 2508 2100 vvvjv.exe 36 PID 2508 wrote to memory of 2524 2508 1lrflrf.exe 37 PID 2508 wrote to memory of 2524 2508 1lrflrf.exe 37 PID 2508 wrote to memory of 2524 2508 1lrflrf.exe 37 PID 2508 wrote to memory of 2524 2508 1lrflrf.exe 37 PID 2524 wrote to memory of 2764 2524 tnbnnt.exe 38 PID 2524 wrote to memory of 2764 2524 tnbnnt.exe 38 PID 2524 wrote to memory of 2764 2524 tnbnnt.exe 38 PID 2524 wrote to memory of 2764 2524 tnbnnt.exe 38 PID 2764 wrote to memory of 2204 2764 ppjpj.exe 39 PID 2764 wrote to memory of 2204 2764 ppjpj.exe 39 PID 2764 wrote to memory of 2204 2764 ppjpj.exe 39 PID 2764 wrote to memory of 2204 2764 ppjpj.exe 39 PID 2204 wrote to memory of 840 2204 9rflxrf.exe 40 PID 2204 wrote to memory of 840 2204 9rflxrf.exe 40 PID 2204 wrote to memory of 840 2204 9rflxrf.exe 40 PID 2204 wrote to memory of 840 2204 9rflxrf.exe 40 PID 840 wrote to memory of 2708 840 lrfrxlf.exe 41 PID 840 wrote to memory of 2708 840 lrfrxlf.exe 41 PID 840 wrote to memory of 2708 840 lrfrxlf.exe 41 PID 840 wrote to memory of 2708 840 lrfrxlf.exe 41 PID 2708 wrote to memory of 1996 2708 hththn.exe 42 PID 2708 wrote to memory of 1996 2708 hththn.exe 42 PID 2708 wrote to memory of 1996 2708 hththn.exe 42 PID 2708 wrote to memory of 1996 2708 hththn.exe 42 PID 1996 wrote to memory of 1756 1996 ddvvv.exe 43 PID 1996 wrote to memory of 1756 1996 ddvvv.exe 43 PID 1996 wrote to memory of 1756 1996 ddvvv.exe 43 PID 1996 wrote to memory of 1756 1996 ddvvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0010cf3e5fd0ee12564d3362401f7923_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\bhhttn.exec:\bhhttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\1vpvj.exec:\1vpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\nbtthn.exec:\nbtthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\thhbnh.exec:\thhbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\pjdjp.exec:\pjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xrxflxr.exec:\xrxflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7bntbh.exec:\7bntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vvvjv.exec:\vvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\1lrflrf.exec:\1lrflrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\tnbnnt.exec:\tnbnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ppjpj.exec:\ppjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9rflxrf.exec:\9rflxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lrfrxlf.exec:\lrfrxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\hththn.exec:\hththn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ddvvv.exec:\ddvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\pjjdd.exec:\pjjdd.exe17⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rrllrff.exec:\rrllrff.exe18⤵
- Executes dropped EXE
PID:764 -
\??\c:\hnhnth.exec:\hnhnth.exe19⤵
- Executes dropped EXE
PID:936 -
\??\c:\ppvvd.exec:\ppvvd.exe20⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rlfxflr.exec:\rlfxflr.exe21⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rrflllx.exec:\rrflllx.exe22⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nbttnn.exec:\nbttnn.exe23⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1tnhnt.exec:\1tnhnt.exe24⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdvpd.exec:\pdvpd.exe25⤵
- Executes dropped EXE
PID:1088 -
\??\c:\flxllxx.exec:\flxllxx.exe26⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hnhtnt.exec:\hnhtnt.exe27⤵
- Executes dropped EXE
PID:540 -
\??\c:\ddjpp.exec:\ddjpp.exe28⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe29⤵
- Executes dropped EXE
PID:660 -
\??\c:\hhthth.exec:\hhthth.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1ppvd.exec:\1ppvd.exe31⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rlxfllx.exec:\rlxfllx.exe32⤵
- Executes dropped EXE
PID:2448 -
\??\c:\htntnn.exec:\htntnn.exe33⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbtbhn.exec:\bbtbhn.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jdpvj.exec:\jdpvj.exe35⤵
- Executes dropped EXE
PID:980 -
\??\c:\7llxlrf.exec:\7llxlrf.exe36⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3nnnbn.exec:\3nnnbn.exe37⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5jvjv.exec:\5jvjv.exe38⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xxrxxxl.exec:\xxrxxxl.exe39⤵
- Executes dropped EXE
PID:700 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe40⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hbnnhh.exec:\hbnnhh.exe41⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9jpvv.exec:\9jpvv.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5dvdj.exec:\5dvdj.exe43⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ttnnnt.exec:\ttnnnt.exe44⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tnhnht.exec:\tnhnht.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rlfrflx.exec:\rlfrflx.exe46⤵
- Executes dropped EXE
PID:1596 -
\??\c:\htbbtt.exec:\htbbtt.exe47⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hthbtt.exec:\hthbtt.exe48⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vvvpd.exec:\vvvpd.exe49⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xlrlllr.exec:\xlrlllr.exe50⤵
- Executes dropped EXE
PID:2560 -
\??\c:\frxffff.exec:\frxffff.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhtbnt.exec:\nhtbnt.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7dppp.exec:\7dppp.exe53⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lflrrxf.exec:\lflrrxf.exe54⤵
- Executes dropped EXE
PID:2700 -
\??\c:\llfxffr.exec:\llfxffr.exe55⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bnnttt.exec:\bnnttt.exe56⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pdppv.exec:\pdppv.exe57⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xllxxrf.exec:\xllxxrf.exe58⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lfflrrx.exec:\lfflrrx.exe59⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nhntbb.exec:\nhntbb.exe60⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdddd.exec:\jdddd.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3xrllff.exec:\3xrllff.exe62⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rlllrxf.exec:\rlllrxf.exe63⤵
- Executes dropped EXE
PID:940 -
\??\c:\nbhbbb.exec:\nbhbbb.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\9tntnn.exec:\9tntnn.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ppppd.exec:\ppppd.exe66⤵PID:1888
-
\??\c:\dvpvv.exec:\dvpvv.exe67⤵PID:2540
-
\??\c:\5ffxrrr.exec:\5ffxrrr.exe68⤵PID:1052
-
\??\c:\9rfrxrr.exec:\9rfrxrr.exe69⤵PID:1268
-
\??\c:\7bhhnn.exec:\7bhhnn.exe70⤵PID:2568
-
\??\c:\thnntn.exec:\thnntn.exe71⤵PID:2832
-
\??\c:\vvdpv.exec:\vvdpv.exe72⤵PID:1648
-
\??\c:\frllxfr.exec:\frllxfr.exe73⤵PID:1528
-
\??\c:\htbttt.exec:\htbttt.exe74⤵PID:1536
-
\??\c:\nbhnnt.exec:\nbhnnt.exe75⤵PID:2972
-
\??\c:\vdvpd.exec:\vdvpd.exe76⤵PID:2856
-
\??\c:\xlxlllr.exec:\xlxlllr.exe77⤵PID:2416
-
\??\c:\hthhbb.exec:\hthhbb.exe78⤵PID:1088
-
\??\c:\bnbtbh.exec:\bnbtbh.exe79⤵PID:324
-
\??\c:\jvpvj.exec:\jvpvj.exe80⤵PID:584
-
\??\c:\lxrllff.exec:\lxrllff.exe81⤵PID:596
-
\??\c:\rlllxxf.exec:\rlllxxf.exe82⤵PID:1872
-
\??\c:\btntbb.exec:\btntbb.exe83⤵PID:1264
-
\??\c:\9nhhht.exec:\9nhhht.exe84⤵PID:852
-
\??\c:\3pddd.exec:\3pddd.exe85⤵PID:1400
-
\??\c:\dpvvd.exec:\dpvvd.exe86⤵PID:452
-
\??\c:\xrrlrxf.exec:\xrrlrxf.exe87⤵PID:1072
-
\??\c:\bttttt.exec:\bttttt.exe88⤵PID:2452
-
\??\c:\9bttnb.exec:\9bttnb.exe89⤵PID:2900
-
\??\c:\pjdpv.exec:\pjdpv.exe90⤵PID:1832
-
\??\c:\jdjjp.exec:\jdjjp.exe91⤵PID:1068
-
\??\c:\xxflfrf.exec:\xxflfrf.exe92⤵PID:1684
-
\??\c:\ttbbnn.exec:\ttbbnn.exe93⤵PID:1196
-
\??\c:\ttnntb.exec:\ttnntb.exe94⤵PID:1952
-
\??\c:\dddjd.exec:\dddjd.exe95⤵PID:2324
-
\??\c:\vpdjj.exec:\vpdjj.exe96⤵PID:1828
-
\??\c:\xrxfllf.exec:\xrxfllf.exe97⤵PID:1512
-
\??\c:\frxflfl.exec:\frxflfl.exe98⤵PID:3024
-
\??\c:\ttnthh.exec:\ttnthh.exe99⤵PID:884
-
\??\c:\vppvj.exec:\vppvj.exe100⤵PID:1920
-
\??\c:\rflllfr.exec:\rflllfr.exe101⤵PID:1276
-
\??\c:\thtntt.exec:\thtntt.exe102⤵PID:2008
-
\??\c:\1pdvj.exec:\1pdvj.exe103⤵PID:2168
-
\??\c:\xllffxf.exec:\xllffxf.exe104⤵PID:2376
-
\??\c:\nntnnn.exec:\nntnnn.exe105⤵PID:2352
-
\??\c:\9djvv.exec:\9djvv.exe106⤵PID:2848
-
\??\c:\lxfrrlx.exec:\lxfrrlx.exe107⤵PID:2064
-
\??\c:\hbhbth.exec:\hbhbth.exe108⤵PID:2944
-
\??\c:\hbnbnn.exec:\hbnbnn.exe109⤵PID:2624
-
\??\c:\ddvdv.exec:\ddvdv.exe110⤵PID:2872
-
\??\c:\xlrrrfr.exec:\xlrrrfr.exe111⤵PID:2632
-
\??\c:\bbtbtb.exec:\bbtbtb.exe112⤵PID:2752
-
\??\c:\jjdpj.exec:\jjdpj.exe113⤵PID:2100
-
\??\c:\vvjdd.exec:\vvjdd.exe114⤵PID:2800
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe115⤵PID:2256
-
\??\c:\nhthnn.exec:\nhthnn.exe116⤵PID:2956
-
\??\c:\tnbbhh.exec:\tnbbhh.exe117⤵PID:2796
-
\??\c:\1djvv.exec:\1djvv.exe118⤵PID:2812
-
\??\c:\vjvdp.exec:\vjvdp.exe119⤵PID:1220
-
\??\c:\1fflrrx.exec:\1fflrrx.exe120⤵PID:2824
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe121⤵PID:2360
-
\??\c:\ttnbhn.exec:\ttnbhn.exe122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-