Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe
-
Size
385KB
-
MD5
24cdd06ab3e7d81f47b5400ad3af2734
-
SHA1
b8800ceeae757dfc5dcb53178c7db4216900ee23
-
SHA256
05ab296edfebac8877662898e320bbce42de720e9140cf48c698e3f61eeabc4d
-
SHA512
abfa7d042461b653d39f27cc42afddd64589fae3549cc756902a7561e3909dbdbd77bcf9ae9419f654b399703cb1844481ca241f05772b4ba5f155bcc7d05569
-
SSDEEP
6144:CPhftTJIlUuELv8wt/0k612sOpQI6BL7oHeHHHHHHHHHHHHHHOGs4Cv9NwIrdJci:CPOlgAwtsdwsOpQIivoGnsN3/o4
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2560 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2556 PING.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2560 2988 24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe 30 PID 2988 wrote to memory of 2560 2988 24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe 30 PID 2988 wrote to memory of 2560 2988 24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe 30 PID 2988 wrote to memory of 2560 2988 24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe 30 PID 2560 wrote to memory of 2556 2560 cmd.exe 32 PID 2560 wrote to memory of 2556 2560 cmd.exe 32 PID 2560 wrote to memory of 2556 2560 cmd.exe 32 PID 2560 wrote to memory of 2556 2560 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\24cdd06ab3e7d81f47b5400ad3af2734_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2556
-
-