Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe
-
Size
259KB
-
MD5
c231c59a8f5a5c8dfabffee532605103
-
SHA1
32ac211960d5b691db6e8fbd9c4b5ed31be13018
-
SHA256
dd6d35e2e470a0ec8f2da3d3b44d810272bd66bbd8ba356f817dd7e87f920025
-
SHA512
12e54a3c3ebc3f79eed1fc1e13e2f931d6cb7104df2349f5e407580bee7a216eb0554069676ede17a55abbed33f9f343200d55e138d31639661a2a3b8641f740
-
SSDEEP
3072:eL1V3mTI2IOGjJmgDpvP2s4rjCqi/HhxqfuXGyyEtfMu034YnNRyZn5I973F/8re:eCTI2IOGdpDpB4SgctfMLyI9rJ8xl3u3
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2528 set thread context of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2676 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 2676 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe Token: 33 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2528 wrote to memory of 2676 2528 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 29 PID 2676 wrote to memory of 1280 2676 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 20 PID 2676 wrote to memory of 1280 2676 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 20 PID 2676 wrote to memory of 1280 2676 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 20 PID 2676 wrote to memory of 1280 2676 c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\c231c59a8f5a5c8dfabffee532605103_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676
-
-