Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 10:29
Static task
static1
Behavioral task
behavioral1
Sample
3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe
-
Size
127KB
-
MD5
3d02226b31f4f46e5685391c00f35ffc
-
SHA1
cf5a807f372da6ff3eb714eb7739af4def5c74b5
-
SHA256
1fc780c4864c6b00e2bbabed30a67f5b4cca78fc42f39392e770c72d5b2031be
-
SHA512
d2482dbd1095afa8402b54d2ab22dbebf9c8bd633b60bb056eb43df078d844e9eece32b84d9fe6c7c9de054c7a07cf87779cfc32e6bd13b50c59b9ee5d7089a9
-
SSDEEP
1536:+ChM13d5uA+QZw3D84SAqHdsJboytAhHArr/0nMC4Nt3NIO2NnToIfBO9Mja:w3e06I6JboHAX/0GZH2FTBfB7ja
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1628 2568 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 2388 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 30 PID 2568 wrote to memory of 1628 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 31 PID 2568 wrote to memory of 1628 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 31 PID 2568 wrote to memory of 1628 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 31 PID 2568 wrote to memory of 1628 2568 3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d02226b31f4f46e5685391c00f35ffc_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\B155.tmp" "8A'. ':':?'7'/'HKIIIMHJOOMNMCNHBJKKHN$18JJCU"2⤵PID:2388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 922⤵
- Program crash
PID:1628
-