Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/01/2025, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe
-
Size
339KB
-
MD5
8bacf4c69cf9737f4ecfcf234201f0a5
-
SHA1
8db881233f0ab5cf54f0153c166e622598d7fdae
-
SHA256
8f649269ce6896569f565d6c3e045c6e09bfd989683f42dc2740db47330de409
-
SHA512
997cb346ccfecc7d9209a8439dd6be9231b1705478560bdb1e5d0559c607128634848e4b6a7dfc6921cea8ae8e3496448eb5eb2ba3c3b29fa184aee024d46349
-
SSDEEP
6144:BiY/Bn0a2SCQtMYpZX4/f0sbuJ7WS48Te:FZn0oCCM694HbuNkme
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2764 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 31 PID 1924 wrote to memory of 2764 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 31 PID 1924 wrote to memory of 2764 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 31 PID 1924 wrote to memory of 2764 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 31 PID 1924 wrote to memory of 2820 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 32 PID 1924 wrote to memory of 2820 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 32 PID 1924 wrote to memory of 2820 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 32 PID 1924 wrote to memory of 2820 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 32 PID 1924 wrote to memory of 2824 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 33 PID 1924 wrote to memory of 2824 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 33 PID 1924 wrote to memory of 2824 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 33 PID 1924 wrote to memory of 2824 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 33 PID 1924 wrote to memory of 3064 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 34 PID 1924 wrote to memory of 3064 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 34 PID 1924 wrote to memory of 3064 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 34 PID 1924 wrote to memory of 3064 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 34 PID 1924 wrote to memory of 2880 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 35 PID 1924 wrote to memory of 2880 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 35 PID 1924 wrote to memory of 2880 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 35 PID 1924 wrote to memory of 2880 1924 JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"2⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"2⤵PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"2⤵PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"2⤵PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8bacf4c69cf9737f4ecfcf234201f0a5.exe"2⤵PID:2880
-