Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/09/2024, 22:24
General
-
Target
d7302ec2d8170d034367175a055760e6_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
d7302ec2d8170d034367175a055760e6
-
SHA1
cb44282047c36d5578e75a9a18489c20b9c3d8bf
-
SHA256
972cd9670c6560cc030d2e3c29aa37bda6a7f9b31d098b2f77c7878bd72d1b31
-
SHA512
835376c9f4d0c10119a9340c637fc97bbd62930c8c5100c5f614807c3953c2550ada36d192a3bccea3c22ffc30c105c9c52c1a0303e5ef959aebba69c18259c1
-
SSDEEP
24576:2+lGwq5obAwT11GKW8bzTiIblKxOYBiFfcEdb9KL8BFaESEPeQbzqH7j8UHxOO7n:mGbsnEV9bWbAUHxO4TY5T0PhZR
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7302ec2d8170d034367175a055760e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d7302ec2d8170d034367175a055760e6_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
1.5MB
-
Filesize
2.8MB
-
Filesize
1.5MB
-
Filesize
2.8MB
-
Filesize
1.5MB