Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe
-
Size
185KB
-
MD5
08d33ebb711e5eb1dbf9b39b5f5bfa1b
-
SHA1
bdda54be7a9f69e76dbf4a142f180f63560fc0bd
-
SHA256
5b962e8d78517f727f36e83b0af896da7882feb0fa15d45f8f6885fe8bd1695b
-
SHA512
feb1c3118eb5a2c0c429f8e6a6f44bc3317c5bdf7ba30c7a07555107d2b25f89670842fa083cd190a0cc3e39636e316bb6f0c0b5a16117bdf1887746cb02e5a2
-
SSDEEP
3072:CDUGAsWjJ9JcjtTVIGsZBvjcXYmSCRIHJkCCkZTtmT5nxWD9vA/Stu:CDUGwN9CJTVIGsZCY4SPCkBwT54Ri
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 976 wrote to memory of 3456 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 56 PID 976 wrote to memory of 3456 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 56 PID 976 wrote to memory of 3456 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 56 PID 976 wrote to memory of 3456 976 08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08d33ebb711e5eb1dbf9b39b5f5bfa1b_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:976
-