Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe
-
Size
116KB
-
MD5
a55706b8ce07935a11d996d52cc2cd59
-
SHA1
64822278cbc9741d539efc3a07db1ca0026498c7
-
SHA256
98ab4acdb6e55f4f525cb2a964063e5abeb499336aa8e123163d44de52c6d943
-
SHA512
695387a7ea00411f667ab3c325bba36742c15223b9220f3ba7848920394255213d8fdaa3ab3ce8ad2a69f12332e92712314c1aef4f2e5344711eb56a77db2b65
-
SSDEEP
3072:raFP0mTuhOQRCO+zMIq59Y35ngilVc3T:r28mToPWDwyay0
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1748 set thread context of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31 PID 1748 wrote to memory of 2516 1748 a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\a55706b8ce07935a11d996d52cc2cd59_JaffaCakes118.exePID:2516
-