Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe
-
Size
28KB
-
MD5
35acaa95678c8c0d8247d264bc16a9ff
-
SHA1
146f1f1f4af12f9fd4af562a0a70f9cdfe449a15
-
SHA256
a1d43d04a81e4df25b1da1f6a9ea9f952dad652a548238a21b71d94861b10eba
-
SHA512
244505aaea69714d4b00ec176732802a79b0317eb367357e2015e8803cf03ac0ffb99c82564527a7820e4b72d61859caed40774f646c8b989fb708fa31ffd4b5
-
SSDEEP
384:rPu7ZGOSexDusYA81pkU9SbBLh9edNXnXDG4/6Y:rPu7s7eom0pkUUbBLSv7i
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1564 set thread context of 2056 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe 31 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1564 wrote to memory of 2056 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe 31 PID 1564 wrote to memory of 2056 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe 31 PID 1564 wrote to memory of 2056 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe 31 PID 1564 wrote to memory of 2056 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe 31 PID 1564 wrote to memory of 2056 1564 35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\35acaa95678c8c0d8247d264bc16a9ff_JaffaCakes118.exe2⤵PID:2056
-