Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 12:13

General

  • Target

    a27bcf92142b5c795b27b121c29dd362_JaffaCakes118.exe

  • Size

    4.7MB

  • MD5

    a27bcf92142b5c795b27b121c29dd362

  • SHA1

    4d824ef614c0637db11ff26b4a9471e0c6a3242f

  • SHA256

    15f49cab774baaca8b38e4526266a4103b243d487f8fc3ac7e8e6c1f4fb6159e

  • SHA512

    1c28ffe68e8d40cc2830a467da69b7da56b8f186fb89a1b7225ab7233db4f7b360a0f6ba7e8abfc00ea88d9ce81c7588093ac15caa30dbd4a5b66dd43f0c5177

  • SSDEEP

    98304:2qy1Li/gNusGYBm8JeRb1xSxHAvhCUUYvOckTP38ndyyCyyy:2qQEgNuAB7JkyxgZbvG

Score
7/10

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a27bcf92142b5c795b27b121c29dd362_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a27bcf92142b5c795b27b121c29dd362_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:1460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1460-0-0x0000000000400000-0x000000000105C000-memory.dmp

    Filesize

    12.4MB

  • memory/1460-2-0x0000000000400000-0x000000000105C000-memory.dmp

    Filesize

    12.4MB

  • memory/1460-3-0x0000000000400000-0x000000000105C000-memory.dmp

    Filesize

    12.4MB

  • memory/1460-4-0x0000000000400000-0x000000000105C000-memory.dmp

    Filesize

    12.4MB