Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe
-
Size
210KB
-
MD5
4a33cef909d7309a80629ca0f8d4cd58
-
SHA1
57c3db6ac8e5b9a593dbe5465b509e068afbe486
-
SHA256
5c6859fb7b6a60c57951afb1c6d361aa2f3b7723ef5a92e792bbfdbe004409e5
-
SHA512
603e844d8facafdc363215acfb19f8eba4b727748d4e8d91182e9688a069316f4737f81794efa89f496ffaa4d5f24952de1460cdd8f735863f72ce5cc369648a
-
SSDEEP
3072:CiMVkuK3J98M0a3sKRERQfzc0ovACpIQ2KWmDJs4YtWSLSfX3LG40DzeW2l9wTZv:8GF9i8JlrchAA9RWystWSuD0DzeW2Hg
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2680 wrote to memory of 1184 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1184 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1184 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1184 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe 21 PID 2680 wrote to memory of 1184 2680 4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a33cef909d7309a80629ca0f8d4cd58_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2680
-