Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe
-
Size
180KB
-
MD5
35144d13f40d68eac70021aeaf31965f
-
SHA1
40b17cd61b704c1adb1c6aaf86d2c5b0d8ea7936
-
SHA256
c545e3d48bfaaccdb5d5c2d41102d18022a67861021b3667a971fff67aec598d
-
SHA512
58aa79f697561377b95a7d1b2b0645bfa05e3d3b63ba39ef760ed30c1818b17c5596bb4db1110ffc01c88dab08fd2f9968a39b638e26b67444493593ca895544
-
SSDEEP
3072:TjYUXT1pmQUuMFuloJZ4j4V5HMZBZTZ5TQKwqQHcCHkQ+3MJ:nYUjMF0qS4MbFZ5TdQHJkQ+3y
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2520 2104 35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2520 2104 35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2520 2104 35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\35144d13f40d68eac70021aeaf31965f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 4162⤵PID:2520
-