Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe
-
Size
132KB
-
MD5
5b53553e10b129bbfab5ad1083a24f21
-
SHA1
5475f3456677726823547baddfb3f17ccf4c4570
-
SHA256
6b0bf0792c7ed9d8a33fb77b707f4203f0b351472ee24b4ee57aeb6154ae3e6a
-
SHA512
1a2ef96a70fec7db4ca1a3b03b2e9aa7b2720b17b5ca2f0bfbd8d7bd446817bcb4c0ecc175ca81416ab6561a729f05c3d16eb01a98a7612373fcc64a7e2169d8
-
SSDEEP
3072:tmbVwykD3t1xqPax9bpz7NwaG/ZU0Itq+:towpD7xq2bpzYUo+
Malware Config
Signatures
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2172 ipconfig.exe 3028 ipconfig.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2496 wrote to memory of 1700 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 30 PID 2496 wrote to memory of 1700 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 30 PID 2496 wrote to memory of 1700 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 30 PID 2496 wrote to memory of 1700 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 30 PID 1700 wrote to memory of 2172 1700 cmd.exe 32 PID 1700 wrote to memory of 2172 1700 cmd.exe 32 PID 1700 wrote to memory of 2172 1700 cmd.exe 32 PID 1700 wrote to memory of 2172 1700 cmd.exe 32 PID 2496 wrote to memory of 2592 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 35 PID 2496 wrote to memory of 2592 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 35 PID 2496 wrote to memory of 2592 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 35 PID 2496 wrote to memory of 2592 2496 5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe 35 PID 2592 wrote to memory of 3028 2592 cmd.exe 37 PID 2592 wrote to memory of 3028 2592 cmd.exe 37 PID 2592 wrote to memory of 3028 2592 cmd.exe 37 PID 2592 wrote to memory of 3028 2592 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5b53553e10b129bbfab5ad1083a24f21_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2172
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3028
-
-