Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe
-
Size
256KB
-
MD5
088b7d219c10187f8594fdc3143b9425
-
SHA1
a95a060fb7f93363f149827542cf6482f23bfe9c
-
SHA256
449b5bb355e1a1cbd27b1f34119e056429fd0fb7bdc64769f7f0b30a1a99a590
-
SHA512
0a1b6c0de917b11c679b8e9d67dd1ad98e59140e19489e62f88585cb181cf45c07419173635a927c5691ef3669f512ddf7e21c658c7d452df45d1ca45778ff5c
-
SSDEEP
1536:mVY2SzOqFK0OEe4qeXwbQgsfPSOwSIkGtiiFJ2Sld1eBayDhRCceKkQhljti3mmi:m2LIKeh+MQgzVpkSlQXjg3mmWz6tCtn
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2900 set thread context of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 set thread context of 0 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1332 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 1332 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 1332 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 29 PID 2900 wrote to memory of 0 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe PID 2900 wrote to memory of 0 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe PID 2900 wrote to memory of 0 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe PID 2900 wrote to memory of 0 2900 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe PID 1332 wrote to memory of 1204 1332 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 21 PID 1332 wrote to memory of 1204 1332 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 21 PID 1332 wrote to memory of 1204 1332 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 21 PID 1332 wrote to memory of 1204 1332 088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\088b7d219c10187f8594fdc3143b9425_JaffaCakes118.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1332
-
-