Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe
-
Size
367KB
-
MD5
97d293c8850806c30e191e5f13704f85
-
SHA1
92be1fab0fa8c79551994aa77fcd460b43305da0
-
SHA256
9078ad0336f0c911008da25dd1ce16e0c9f1b5bc177a4d5d6dcba8714dcf1fa7
-
SHA512
5e970d1821b8d1006cdee46c8f41770e4a81f20f2932b6ebdb0718916b0cedd7f3bd03128471eaf64a41ef0a725b77b400972191569c0f55f0077a4cb2fca19f
-
SSDEEP
6144:rpEcAd/Mm5ZkyUneRTnJOmQ4W4/6zA5K0TzJRCp4xRvKUllD/W13+N8:rTAOm5eyUnJmCzAXTzJR3RvK6lCwN8
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2804 2940 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2804 2940 97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe 28 PID 2940 wrote to memory of 2804 2940 97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe 28 PID 2940 wrote to memory of 2804 2940 97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe 28 PID 2940 wrote to memory of 2804 2940 97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\97d293c8850806c30e191e5f13704f85_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 1162⤵
- Program crash
PID:2804
-