Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 05:36

General

  • Target

    8d840af424324e20195e67958bf46c50_JaffaCakes118.ps1

  • Size

    55KB

  • MD5

    8d840af424324e20195e67958bf46c50

  • SHA1

    71a526ab59cda1d3a057872debd82d147caffd5b

  • SHA256

    45131519856c47cf1d0176925ea247dd5c72a19481b205a1a56feb10c38c9591

  • SHA512

    c958108f323fc23ae172a4aedfbf645da415b946c4225a905808bfa348a511f41cf9b120087ca966d978193e6806271dfa8b9c7407731bfaebd315a0f14311a6

  • SSDEEP

    768:uv7Nu8Q7qpmjPNxud0T3366bmoSn4KhhcRZ8+1s7/uvAXZfe8fapBjL9T/INeKiT:ZljPpYoS4ihcRe7uoXZftCpBjL90NJM

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8d840af424324e20195e67958bf46c50_JaffaCakes118.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2872-4-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

    Filesize

    4KB

  • memory/2872-7-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2872-6-0x00000000028E0000-0x00000000028E8000-memory.dmp

    Filesize

    32KB

  • memory/2872-5-0x000000001B550000-0x000000001B832000-memory.dmp

    Filesize

    2.9MB

  • memory/2872-8-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2872-9-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2872-10-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2872-11-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB