Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
2ef5bc7e3ea077223ddeb130e428140a_JaffaCakes118.js
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2ef5bc7e3ea077223ddeb130e428140a_JaffaCakes118.js
Resource
win10v2004-20240704-en
General
-
Target
2ef5bc7e3ea077223ddeb130e428140a_JaffaCakes118.js
-
Size
183KB
-
MD5
2ef5bc7e3ea077223ddeb130e428140a
-
SHA1
2703976ee122a4f0a618fc69e53aa25a313cee7f
-
SHA256
66ae152ddc0d2e4ec4836f7ab4d6c1822d3bfe746d34c8fc24f57f15e8e16ec0
-
SHA512
cd4f2abf643beff86d75fcfbb48cabe1101db98c70720e8a75c60db59e94bc08846eaf4f7dc648277f7225e89ab559830984144e3a8c64894c9585a0149feab3
-
SSDEEP
3072:aGTydvzf78BsUDnOMPTVjTDVoP9WhePMfa2A5izMAFKMulAXTMvBnPUSD5l:aGI7f7LUbZVjTJuWhePMCts4MRoZ55l
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1760 2408 wscript.exe 28 PID 2408 wrote to memory of 1760 2408 wscript.exe 28 PID 2408 wrote to memory of 1760 2408 wscript.exe 28
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2ef5bc7e3ea077223ddeb130e428140a_JaffaCakes118.js1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\lzmzjnoci.txt"2⤵PID:1760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD572e3da2f8357c43f4fdf82a9479a1c85
SHA10b3b520fdde7958f9d02e388130ff5f6dc3dc1b2
SHA256b1d480ddc3655879f8639184af5f1e6441660dc37216a8079982046e6e60c6c5
SHA5120892f05ec27661901a01015b3751d7575ecafd5468ab33fb157ceb5072a861a4b0d19cd8d0b8cfc89fadde4cb02a9e2e13d52ffbad35fdd1e728c15a9a8c7bf4