Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe
-
Size
458KB
-
MD5
14db2dca825fdcdaf5eeb82ae827ccdc
-
SHA1
4390e73a0f664d43c30a389f9285cfe68be4bec1
-
SHA256
155a096b9785b23359d70039e1a0b6c0b56605d2596a52c7e8138531065d6c39
-
SHA512
f8ebbc329ac94b7b181c2f4c620aa54325086c0c95e560355f4d13cfeed1c33f4224d129e975a6830267505b7e9894f6c928b28a5aec7316d08d4ef5740c558a
-
SSDEEP
6144:qJ6VANOasIMiWxBdMt3VcOmHiMGyWbeSXR7e80sYcM4U:qcObyByt3VEgFeoU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2764 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2916 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2764 1620 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 30 PID 1620 wrote to memory of 2764 1620 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 30 PID 1620 wrote to memory of 2764 1620 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 30 PID 1620 wrote to memory of 2764 1620 14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2916 2764 cmd.exe 32 PID 2764 wrote to memory of 2916 2764 cmd.exe 32 PID 2764 wrote to memory of 2916 2764 cmd.exe 32 PID 2764 wrote to memory of 2916 2764 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\14db2dca825fdcdaf5eeb82ae827ccdc_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2916
-
-