Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 21:54

General

  • Target

    7163a757bd463083f95f825d154dd5e8_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    7163a757bd463083f95f825d154dd5e8

  • SHA1

    1a3288d8a904977b7db12d3cfbed8439885dd48d

  • SHA256

    0d932f49f87b4ecba72765d33acc22449f77623e19de7e2f701b45adda218416

  • SHA512

    608b2a9cad89d212daea8be39acd3c8d7b813454545982dee983c30399a302c657afb6ca46be03092f08236b782f4cc2179c8a6558a86b0258cd74eb4ba71ac3

  • SSDEEP

    1536:AVmflN4KBWVu0mpqvj4FQADpdTLOxktK1KVRUIfalDO1dzPYykH:Jj4mWVu0mpqvj4FQQVSStzFisHPc

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1252
      • C:\Users\Admin\AppData\Local\Temp\7163a757bd463083f95f825d154dd5e8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\7163a757bd463083f95f825d154dd5e8_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Users\Admin\AppData\Local\Temp\7163a757bd463083f95f825d154dd5e8_JaffaCakes118.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1252-18-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/1252-21-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

      Filesize

      4KB

    • memory/1732-0-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/1732-13-0x0000000000400000-0x000000000040D000-memory.dmp

      Filesize

      52KB

    • memory/2912-11-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2912-5-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2912-14-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2912-15-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2912-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2912-3-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2912-8-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2912-16-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB