Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe
-
Size
216KB
-
MD5
f9fff623168e9e240a5c224cc41443a9
-
SHA1
9d67bb3638a21162495886b51d9d38df14957348
-
SHA256
6d222c1a1efb59bb4a5522979f7f648c783c7ce03a6be5031c1d8125a8dd2c62
-
SHA512
df701c8641f501df96db51b46d437bd18d0143024e3de3382541f3297f328e9350b265c166627aa8fb464bc8753457fcaf7f04cb0e740075f122cb04eff8271c
-
SSDEEP
3072:FZE2FrVViMrhmRk+EyVjYYrBde25VwB5t+:F3VZ9Oj5Bd9K5
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Set Value = "c:\\dir\\WinSet.exe" f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft PROLAN = "C:\\dir\\Prolan.exe" f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1968 f9fff623168e9e240a5c224cc41443a9_JaffaCakes118.exe