Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 10:41
Behavioral task
behavioral1
Sample
4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe
-
Size
24.1MB
-
MD5
4c79dfac9072c6e3d7575e8b02ddae7b
-
SHA1
9667a01ed7873a0540733130c89d4f53df2b54da
-
SHA256
6e7d973ed5250d9755b3d6f22884262226befeaf4cca538729d31a691ff99e11
-
SHA512
ae53e0fce49430671d671d9792d7e9481aee38e2c67f4aa017b5df41f6d9f18df18628f83b9457457d46ff466368c6741f7ca80e2875db07ed46d522a4f30d50
-
SSDEEP
786432:sZCEDVfjrRj0r6+bUno0j4ILgtN35TbdXT:2CYbr50rVOoSK53t
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2420 4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2420 2660 4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2420 2660 4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2420 2660 4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c79dfac9072c6e3d7575e8b02ddae7b_JaffaCakes118.exe"2⤵
- Loads dropped DLL
PID:2420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD51d5e4c20a20740f38f061bdf48aaca4f
SHA1de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA256f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
SHA5129df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397