Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe
-
Size
94KB
-
MD5
2350aff565533d5d712e5fe03751ff0e
-
SHA1
093892ed608775a3ebb02cf31edb25e1321f3e6e
-
SHA256
882bc9401d410e968c94af254e5ca389b93a6bbbefdedc8e705c86c9c6a85fb8
-
SHA512
b6150bfd583a087290e4d3ff9959b28aa7f78ee483ea1bd6ec5bbb010ce5a7c48ff21ec5cb0016aaf55f906caa15f1f53821f24a7b5de9ff1c7152da9c63b1ad
-
SSDEEP
1536:nfd36h9AWMA27R4XVjkFKRxvX70yGvqapCzz16N9V6CjH5zDtBNb5qk9d/:fdqh95qR4XFkaxvXorvHpO0VtjHlbNb5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2384 2104 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2384 2104 2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe 28 PID 2104 wrote to memory of 2384 2104 2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe 28 PID 2104 wrote to memory of 2384 2104 2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe 28 PID 2104 wrote to memory of 2384 2104 2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2350aff565533d5d712e5fe03751ff0e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 362⤵
- Program crash
PID:2384
-