Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe
-
Size
40KB
-
MD5
073c6af1e0ea2be37f23c47521029e9c
-
SHA1
1adf7e76479d0d70b473da5848e653b4eb978057
-
SHA256
7e29c6210e963e10fd4ac755e4048b67b387c8481b34c14b7fda0ec2741a92e3
-
SHA512
69ca5916b8b3afd329f3b23b5c1dca31ad6bbd203ae7e017f1640332b511c6f9cf897f58db682ed50ce97cb4cc34bf4ffaff457218699d6d51df51e0c5b92a32
-
SSDEEP
192:/tcLqu6eqSsTsX2tb20VuJLxonQT1h1646XUcxFbAIGJ9hXbikus8YkH7:/qm+qJGYEGuh164InAIyrNuh
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2348 2164 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2348 2164 073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe 28 PID 2164 wrote to memory of 2348 2164 073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe 28 PID 2164 wrote to memory of 2348 2164 073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe 28 PID 2164 wrote to memory of 2348 2164 073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\073c6af1e0ea2be37f23c47521029e9c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 362⤵
- Program crash
PID:2348
-