Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
6a55fd4ad94945afa83646958840242b
-
SHA1
e27d6ae270171f15252da05b5f28a3d57d41e373
-
SHA256
cd7d073848c9e998cf3e5bd0efddd7f09c4907c9986dc9352e49f47d3064e70a
-
SHA512
d987036fe27821ba22451243584b0b2c6fcbbc94d1e35c4eca8756086cc928cc674050ca295ed55d8e4fef991464d3034d4456993263573f2350e7a1cae452a1
-
SSDEEP
24576:WvdYAcUR0mSQOZJcDshAIQmQIIxVB9iLNUHUpHHPDrlkyKG:m1cHOOc6AYYxh4WaPDrlz
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3060 2072 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3060 2072 6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe 28 PID 2072 wrote to memory of 3060 2072 6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe 28 PID 2072 wrote to memory of 3060 2072 6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe 28 PID 2072 wrote to memory of 3060 2072 6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a55fd4ad94945afa83646958840242b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 2002⤵
- Program crash
PID:3060
-