Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe
-
Size
136KB
-
MD5
178d23cf3dd5ebdda20cefbf23eb3386
-
SHA1
163897436aa97bfa283b45c4b0fd978ba99dd8e7
-
SHA256
8dd8f6aff8b821ffa3821891c4de529d4dfe405c9e6b2616ed00467f161e0dcd
-
SHA512
ba30e1e33ee1ce11cfa1f25938bb6ffa6d411717036c65d7fe35ef761e4b515d5fb353b0b96536c7c645c06f3b39bbe7686409d16c9dd7f21e2bcaecc2895cbe
-
SSDEEP
3072:anm3DXh2VA97Yx7MIZYAaftVuHRorGq8WweZnDM2LaShRwEp/J:L61x7LYJnrVPRDM2W7Ej
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2684-6-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/2684-7-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/memory/2684-3-0x0000000010000000-0x000000001000F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2684 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2684 2648 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2684 2648 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2684 2648 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2684 2648 178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\178d23cf3dd5ebdda20cefbf23eb3386_JaffaCakes118.exe?2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2684
-