Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe
-
Size
424KB
-
MD5
a8d6c7bdb7d26cc54cc6938aad540b84
-
SHA1
6d3ad41053915a82776b104280c4429e5ac5635a
-
SHA256
7b2b4aacdc891da96a03c24092d5f184ec18671a06701ff38d23850f10149887
-
SHA512
08fd1e150991526a2540b5ab46ae5343b263cdd25b96968d07a24080a83c63e05b2850d63bdcdadda6a304445823d131bdaf981532076033ba0b15fd7a4ca8f9
-
SSDEEP
3072:IY3QRzzMhBRiF15GwG6UMnigzGkilsR6mxZus8s0HRD68wbaxnDkk3QUrJY:I6KR6mxZ50xD68wuxgk
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2764 set thread context of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2992 2764 a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a8d6c7bdb7d26cc54cc6938aad540b84_JaffaCakes118.exe2⤵PID:2992
-