Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe
-
Size
45KB
-
MD5
64ff59ab2a7c26d1e35c392a40a32651
-
SHA1
4a879d6eb9dd963aef0f2659c652f00c2df57121
-
SHA256
f0f4349c8d57a9a88a7a2227e2af1d60c654b87563db1db8ad803ad3ebe66984
-
SHA512
41e4ed2cab58ece02fd510f89ffa44d1d8697b0df0c06ad50b345dc0bb1d207338c558508247572b8c32f3d0c6307572b9a99e3acabac8fd78a14fa3f19523d8
-
SSDEEP
768:JdHlAaZ+bDEgMdSPdroTF0spogHZcKSwFC8tLbRpVFBAasVEFa6hr380JzBagvBq:ZAEAgRSF8poOZmYnt5kaMKr1JoML
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ir32_a.exe 64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2292 64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2292 64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe Token: SeSystemtimePrivilege 2292 64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1256 2292 64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64ff59ab2a7c26d1e35c392a40a32651_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
-