Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe
-
Size
60KB
-
MD5
5d8c5152ad7e8e0a94c308b55c65820d
-
SHA1
69fa2e836b56335cdfb308e29ea2787c4f5bfbe6
-
SHA256
1f2925a77139176c5ad8f635a15b8735124866b807f57ee82b8cbfa0a122b2fa
-
SHA512
5f2fd432a02503ccca47aaf5ffbd340a0337268f15aad82c6d0e644ff931b15f4e0ecbf26bb24dbaa82be16b4c26b1f005a4febabf79ef51e37b2553adc7834f
-
SSDEEP
1536:VJIJ8P7xlXiiNqPBznm7DGs+0syJQi1T15QBpanp2E4H:VnP9lXMy7Du3y7T1uw2lH
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4960 2852 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2852 5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe 2852 5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d8c5152ad7e8e0a94c308b55c65820d_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 2762⤵
- Program crash
PID:4960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 28521⤵PID:1660