Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
427e1353f0d627db47c406d053a19622_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
427e1353f0d627db47c406d053a19622_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
427e1353f0d627db47c406d053a19622_JaffaCakes118.exe
-
Size
88KB
-
MD5
427e1353f0d627db47c406d053a19622
-
SHA1
05bbf16bf9f346b66835214b56f0d571efad345f
-
SHA256
948039b585c37e6f907989110f65b75455bd376d7b17bbb32de223bd7dfd2572
-
SHA512
f5e8b23eeceaff03f3fd2b360df3cd6b57bbea0e1beff1953946b93d20e495a831c47d94a656e3ee76f6a4e6eee99671cd74112684731bcfefb1a29df788e7aa
-
SSDEEP
1536:Gwp1X4Wr5PELJ0E+Ngdv6M8T5/bAl0QL4I9TD+JJpx2Fdjuw41aWrFe:GwpJ4WrueEEglsF/qHx9Tgz2FpumEI
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1048 600 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 600 wrote to memory of 1048 600 427e1353f0d627db47c406d053a19622_JaffaCakes118.exe 30 PID 600 wrote to memory of 1048 600 427e1353f0d627db47c406d053a19622_JaffaCakes118.exe 30 PID 600 wrote to memory of 1048 600 427e1353f0d627db47c406d053a19622_JaffaCakes118.exe 30 PID 600 wrote to memory of 1048 600 427e1353f0d627db47c406d053a19622_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\427e1353f0d627db47c406d053a19622_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\427e1353f0d627db47c406d053a19622_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 882⤵
- Program crash
PID:1048
-