Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe
-
Size
20KB
-
MD5
4d6e6625db0230e4ea40549c92495ee5
-
SHA1
56889fc14c7f8b9faae72d8b25b1449e72ae2b27
-
SHA256
925c086de40cc325004a4b21b5754ea9969efac5eee2d3034788da89fe759792
-
SHA512
df0d1495707ad72a80444df3607a710b89c07577c21c751575cd17310abea4e8c152c3410aebe8ba18a0ac80fd7383454d5597db4c59b69de5c8feeeff48d6e8
-
SSDEEP
192:O1N57EMi5IYMai72vQu6c+KXuFgDTzOaPkrUVNZxsSPOm:OEn5vi72v51XdirUVNZ6SPJ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2288 2280 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2288 2280 4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2288 2280 4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2288 2280 4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe 31 PID 2280 wrote to memory of 2288 2280 4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d6e6625db0230e4ea40549c92495ee5_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 442⤵
- Program crash
PID:2288
-