Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 07:03 UTC

General

  • Target

    95149f3aeaeda9c360350b0eb2dcb7bf_JaffaCakes118.exe

  • Size

    144KB

  • MD5

    95149f3aeaeda9c360350b0eb2dcb7bf

  • SHA1

    b547dba637258ee3e1a1a2804d3d84c4c4ee452a

  • SHA256

    ca6c957e6ac70466643f1507ed9af41f7a15a07911aab0a79f52fb39be45c0df

  • SHA512

    1673bc396e00031084e51992cb36bbb4fa5a0e2f3e7e983ddf72ce86ccf3e26ad48c776d11b3442bd5c200f20fbb41f1349e3c0a3c1b337e77808ff07af1d292

  • SSDEEP

    3072:bXPDykjCBL2hyRq7D6zdr3OP+kdMThQI:

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95149f3aeaeda9c360350b0eb2dcb7bf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\95149f3aeaeda9c360350b0eb2dcb7bf_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Users\Admin\AppData\Local\Temp\95149f3aeaeda9c360350b0eb2dcb7bf_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\95149f3aeaeda9c360350b0eb2dcb7bf_JaffaCakes118.exe
      2⤵
        PID:2364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2364-2-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/2364-4-0x0000000000400000-0x00000000004083A0-memory.dmp

      Filesize

      32KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.