Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 01:35

General

  • Target

    0d520d4f5db656fd589b95cb97241713_JaffaCakes118.exe

  • Size

    785KB

  • MD5

    0d520d4f5db656fd589b95cb97241713

  • SHA1

    4b1403461ecef03a226153a241d08ef83172a3be

  • SHA256

    6896fe1f424e7646ed3f82c5a318de4044e344a03344fb74ef274d78166371b6

  • SHA512

    d6114dc697bda63e30e0e789ec22c9f694942e45863b3c448ab3f99a445d76f1fcb0ae53ac6286c8e12aae9be70ee358ab39c32759f7ffdca5fbf47ef692c29d

  • SSDEEP

    12288:w49JaK9o1Ycd9cbCUnoF04qJNmWhwc6BQg484/xBST78OciIOc:w42IoKoqW9W4WmWhiGg4X/xAXf

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d520d4f5db656fd589b95cb97241713_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0d520d4f5db656fd589b95cb97241713_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1848-0-0x00000000749EE000-0x00000000749EF000-memory.dmp

    Filesize

    4KB

  • memory/1848-1-0x00000000000A0000-0x000000000016C000-memory.dmp

    Filesize

    816KB

  • memory/1848-2-0x00000000749E0000-0x00000000750CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1848-3-0x00000000749E0000-0x00000000750CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1848-4-0x00000000749E0000-0x00000000750CE000-memory.dmp

    Filesize

    6.9MB

  • memory/1848-5-0x0000000008830000-0x0000000008832000-memory.dmp

    Filesize

    8KB

  • memory/1848-6-0x00000000749EE000-0x00000000749EF000-memory.dmp

    Filesize

    4KB

  • memory/1848-7-0x00000000749E0000-0x00000000750CE000-memory.dmp

    Filesize

    6.9MB