Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 19:34
Behavioral task
behavioral1
Sample
e9d57b300d89f104f5eb5236e567f3c7_JaffaCakes118.doc
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e9d57b300d89f104f5eb5236e567f3c7_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
e9d57b300d89f104f5eb5236e567f3c7_JaffaCakes118.doc
-
Size
1.3MB
-
MD5
e9d57b300d89f104f5eb5236e567f3c7
-
SHA1
2b1c2293354d6377f248a383b60e6a9cf8a58f9c
-
SHA256
b1ad94102ee3a51ea6eb6357abc70076df8034dbbbcdc88eb2ab8a503c938ba2
-
SHA512
3348c58ab7a28f714e4941a073ebde3fe7709157f58bf9cee1232eb5f9b9e99e2d42f13b30bacd70f352f04feb8820afe9ee63eab128317ee8bf44a389651533
-
SSDEEP
24576:01aJapulktRe64z5GFqE6kaHrGik9wbDI9APsNMKl5K1YRhg:n4mNqB9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1392 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE 1392 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e9d57b300d89f104f5eb5236e567f3c7_JaffaCakes118.doc"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1392