Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 06:14
Behavioral task
behavioral1
Sample
3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe
-
Size
70KB
-
MD5
3c436ec247e04b853fc02924d9e4bd12
-
SHA1
0c505c78244a52082c750caa72da104e2dbeaa9b
-
SHA256
66d40a38caf22eb1a8b84e956d679dc977bc844b7e5195e0e75d74af40bffebb
-
SHA512
d0951e43c43ecaabbc158ed9ea9bc362958611b46bcd9a843f171a086d452bf3b7d1904a2736524f5aa68f606492e0bd1c6b8746b3d363a40d943214fe3ca5ec
-
SSDEEP
1536:S4tFE0rV6x0KEuvzmzeU7R5Ogjhn/ti1jW6SurfFDhsYXVO:S4tFfreX7geUJFti1jW6Sur9DOYXV
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2580-0-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2404 2580 3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c436ec247e04b853fc02924d9e4bd12_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2404
-