Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35052f149100475f8307e1d04697ed32_JaffaCakes118.exe
-
Size
932KB
-
MD5
35052f149100475f8307e1d04697ed32
-
SHA1
6aa986abbd9ee14710b34a4e631520d100cef8bb
-
SHA256
2e4c25d5f045a2211f26421511fe5707bc6a754aa3bb3548bf74c8fa2b1b28b4
-
SHA512
54e293a74b90ffabb39cc015a17b55fa22d3e2cd0a898a68739eee6fc9488c8cebf9e05ff26f9dbcb2ba6d1e288c3a1ac09edf1375857f4f09b8a14aa5553bec
-
SSDEEP
12288:1Xmc2JMORj5NPrpGa9a1U53gbFm33WP34Hrk3ajUWm2mDj4nnmsEmS:B5qPPltA1UtF33WA9jUWm2mDjdH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2176 cmd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2176 2964 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 30 PID 2964 wrote to memory of 2176 2964 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 30 PID 2964 wrote to memory of 2176 2964 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 30 PID 2964 wrote to memory of 2176 2964 35052f149100475f8307e1d04697ed32_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\35052f149100475f8307e1d04697ed32_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.execmd /c .\qelizresa1.bat2⤵
- Deletes itself
PID:2176
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239B
MD5d6b1f5f225c4f1df127db0273ce51270
SHA1ab06a820e723537d3e66bb92da194bc8cf17ad20
SHA256f5730a8642942f7fdad29bdd9be7a5f11c43175c82bb3185b1d210ad6c7c4727
SHA512bef9b0edd513fb5e3ebf64163d51e7a71d1caee20f0f566a8d1a204a73004bd4528cb166eb5243168752655d7196b7f7920bed51cbd625eeea626bf3d63c1b25