Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe
-
Size
659KB
-
MD5
47ac5481af24d3352cf4caa507ac7614
-
SHA1
a5c70d9c8479be44d87a140a807c0174e780afd8
-
SHA256
69645bbea82c25e47086036c1966ae92a052217d59d920ef0fc760b6e7602949
-
SHA512
3eadbca5b7cc76041fb8b46e8ba11208e3a1a60a8307472a8653b3c973dc0be5af2fc64af90a909a5e2748f8404716fda3a4dd7b3e6256026715d4751ba9c298
-
SSDEEP
12288:dFkNrkfi92NQ1UcKOqJsDTakFsfQEjPxi1a8LT0dBLUaeObGwo:LklkDQO7Oscef/Zh8PSTevwo
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Windows\\system32\\help.scr" 47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\help.scr 47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\help.scr 47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2200 47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47ac5481af24d3352cf4caa507ac7614_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2200