Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe
-
Size
725KB
-
MD5
357de0a2e1ffa359ed132eb59504b434
-
SHA1
2e3119f7a71618f4a62204c8754fb1139b35a622
-
SHA256
ee1a76a3813dd1647293026b6f1bf9a2c91f2891e5204541dc6f322db844cac7
-
SHA512
840fe82f941475ca67cdd14610b18fa246e78a8a93d23ad6afdb1830668d686f15af4e5f5e4f190f9e484e22740d3e7b13b4aad5f5d9c2a25b865b8b7deaaf1d
-
SSDEEP
12288:xoZFZ3keFABgoG1DNJCI8nJ/X2vc1YNJJor0Ll7XmermR0Ew:SVhAyh+JvbYU0Z7Fro0d
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Main = "C:\\Arquivos de programas\\357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe" 357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1980 357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1980 357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe 1980 357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\357de0a2e1ffa359ed132eb59504b434_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980