Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
4949efd28408b358897da28bf1f54b76_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4949efd28408b358897da28bf1f54b76_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4949efd28408b358897da28bf1f54b76_JaffaCakes118.exe
-
Size
648KB
-
MD5
4949efd28408b358897da28bf1f54b76
-
SHA1
f88e18e3fecfa105c5745d0cf36315d94ebe2d4a
-
SHA256
9589c331cbdc34eec7261d5ceed17e7456d910a5fe4c35af538d6804bda38623
-
SHA512
6a62a8021a5f8389ded9862d2f142329b7387c0d2da88310ea74843d66cb94b3620b2da932012d5dfd704deecd5142b6c191361fb864d0af91880ef3e1339ddb
-
SSDEEP
12288:0/+L5yZhO09pk9EfTwK6R/k+4gergi7Jwgc6spEAi2zTxncCI7h:2+dyq0OU0KS/kBPrgOJwgcvEAiy1cCy
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 2612 1836 WerFault.exe 81 2188 1836 WerFault.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\4949efd28408b358897da28bf1f54b76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4949efd28408b358897da28bf1f54b76_JaffaCakes118.exe"1⤵PID:1836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 5402⤵
- Program crash
PID:2612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 5482⤵
- Program crash
PID:2188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1836 -ip 18361⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1836 -ip 18361⤵PID:3452