Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe
-
Size
298KB
-
MD5
39212a7c673b2fa336c754f9d937fa3b
-
SHA1
06f3bc882c5efcee455b8c8401f1f9f4d759293a
-
SHA256
c8489302618f62da9838943079014ec0fd9e5462e500c1447f225514a2aa1e96
-
SHA512
cd4906a1040ee1ee8cea97e5d18c1092d806d92f23b5951bff6bae3c8237547f5bd4bf49d1de48d80f3e0d526361c88892137dfb16d43d6056d9e4abd0647dd7
-
SSDEEP
1536:0GLclDc1QnK67wuIpePFC4XvXDVXNNv+8rCly17sy2oU4TWvJzTco/xih6X1uspC:Hog1QK60KH/XDYACcgaQJFJI6sCvrO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2548 496 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 496 wrote to memory of 2548 496 39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe 30 PID 496 wrote to memory of 2548 496 39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe 30 PID 496 wrote to memory of 2548 496 39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe 30 PID 496 wrote to memory of 2548 496 39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\39212a7c673b2fa336c754f9d937fa3b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 922⤵
- Program crash
PID:2548
-