Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
49f828014fbe14644fd4150269e4c12e
-
SHA1
730f52d6ecdc68923097ed259a9846f0b151bb51
-
SHA256
6ba895d40702f8f030900e8b6ace2e3428aabb541d60173d851db2e7b45e6d2f
-
SHA512
60ad59d3ef5033ed23150bcc6be84a4a83f1f189ae1130c1c1dc2582be820f0f6120a8e74d547fe9c0d19ca05ab70c0e3a52b41fef45b17dca3c20075a061089
-
SSDEEP
24576:v6EstmmiF96iACdYVhlFE5guOdPjM3t9nLAPGnGQotdXmhlL+:iEsQmq96zCdYVtwp3t9nLAeToj
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\taskmgr.exe 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskmgr.exe 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2656 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2656 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe 2656 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2656 2076 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2656 2076 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2656 2076 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2656 2076 49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\taskmgr.exeC:\Windows\system32\taskmgr.exe 708 "C:\Users\Admin\AppData\Local\Temp\49f828014fbe14644fd4150269e4c12e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2656
-