Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe
-
Size
6.4MB
-
MD5
b7ebfc4889b8400292dcfd82f06c3dd5
-
SHA1
f7414cd4e4ae684e3d5cc52c4759e8bc16a88734
-
SHA256
0ef3b236bd90c07e7f1b030c5d5e42a3e6e734eec0a47faa6ef62d62cd4bd2c5
-
SHA512
ba3a7d0da3126399236c7530cade3b1e7f50c7a6fa282bb0f03a3627ab239872c88903f5b91fd0a57ed28b3c0479c991c6ee0caafa74c541ac7df53ff61acc29
-
SSDEEP
98304:FzeoDRJ/WoD1rHz2/U/nlpsuaZXK6y0igIDq:te0Jvz2/+OHyNgJ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2916 set thread context of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4776 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 4776 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4776 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 4776 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87 PID 2916 wrote to memory of 4776 2916 b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7ebfc4889b8400292dcfd82f06c3dd5_JaffaCakes118.exe" ""2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4776
-