Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe
-
Size
251KB
-
MD5
0d993fcdfa3dde65e7f3b450a752490f
-
SHA1
bdd783adf04e0594f3d086d690b8a1f340e6586b
-
SHA256
a0535b1ced3fc56b220a3d975b9774b1619cbd0d765c58969b1b1e5f2fef20b4
-
SHA512
bdc935d575f671e65ab3f68ae91472ba0118bdf0e70b6d5f8cadab445ee245850dbe63ffe2d2eda5f32f0460ae530a336fad8190426694566b116c2e625651e2
-
SSDEEP
3072:wvjAYZeu9Xb8YPRSqmp6sksmTkFfSfOUnTAS9Nm0er/ROYNjkanOLr1+Rs4y1+qH:gEYZeurpSqnTkQj/heFOYN+gRs7M3hu
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 216 wrote to memory of 3516 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 56 PID 216 wrote to memory of 3516 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 56 PID 216 wrote to memory of 3516 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 56 PID 216 wrote to memory of 3516 216 0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d993fcdfa3dde65e7f3b450a752490f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216
-