Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 00:25

General

  • Target

    8c98677e2dee86197e1539b482d9c422_JaffaCakes118.exe

  • Size

    42KB

  • MD5

    8c98677e2dee86197e1539b482d9c422

  • SHA1

    4cd7877a2699188bae68324a8667d31ab6481166

  • SHA256

    1d5946a91b924c67e042d62db76136b39a79ee15ad8f51515e3bef2a45218f9f

  • SHA512

    93d3ce52ebb1aac301b1583180007ef1a38c61d77ade964272dd65c4833088c48696ddc261d1920f9eaa42916c12d9e47b1463d5f321b7ed37503e8374709b82

  • SSDEEP

    384:TJQGipwy9ATmLMrt20gImgdGFOglrjAxfr6+S9Pfu7n5YC45sVBCn3wjB8:NV5y9ATmLMBLquGFO9xOdeVY9yBywj

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c98677e2dee86197e1539b482d9c422_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8c98677e2dee86197e1539b482d9c422_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\8c98677e2dee86197e1539b482d9c422_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\8c98677e2dee86197e1539b482d9c422_JaffaCakes118.exe
      2⤵
        PID:2704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads