Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 02:12
Behavioral task
behavioral1
Sample
3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe
-
Size
79KB
-
MD5
3fca0366078046f32cba836f8c8bece3
-
SHA1
89296d2c5264517503af900b6395d5e734083a05
-
SHA256
581bfaa2729f7be4d390332e069568754a559eed55838981d1542669f7f72737
-
SHA512
b94ddd357a97d38c6e7c62207d6f37f3c4bed0b0772a026418e1103ace47d9256feffdf006fc95b0f079900b5f33df3bc5c43aeaaab12678911015ba4c57aa3b
-
SSDEEP
1536:lfaWM+j/5sKgI88hmt5vKvTXr7NDFZ+oqVlNohEgsFzd7DgvglK+FBlkeqYcurTn:lfamLq8hwKv7Z+oagC5CUB9cuqnyB
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2488-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2488-2-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\arqrk\\command 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\arqrk 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\shell\\arqrk 3fca0366078046f32cba836f8c8bece3_JaffaCakes118.exe